CVE-2017-3162

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0...

CVE-2017-3162

Apache Hadoop CVE-2017-3162: A vulnerability in the HDFS namespace browsing flow where the DataNode servlet accepts a NameNode URL as a query parameter without validation, allowing an attacker to bypass security restrictions. Affected software includes Hadoop versions prior to 2.7.0; the issue st...

Apache Hadoop DataNode Missed Validation Vulnerability

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated. Apache Hadoop versions 2.6.x and earlier are affected. CVE-2017-3162: Apache Hadoop DataNode web UI vulnerability Severity: Important Vendor: The...

CVE-2017-3531

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Servlet Runtime. Supported versions that are affected are 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to...

Buffer overflow

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Servlet Runtime. Supported versions that are affected are 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-3531

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Servlet Runtime. Supported versions that are affected are 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-3531: Undefined Security Weakness

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Servlet Runtime. Supported versions that are affected are 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to...

Oracle WebLogic Server 'Servlet Runtime' RCE Vulnerability (cpuapr2017)

Oracle WebLogic Server is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Directory traversal

Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. dot dot in the sn parameter to brightmail/servlet/com.ve.kavachart.servlet.ChartStream...

PT-2017-8706

Name of the Vulnerable Software and Affected Versions Symantec Messaging Gateway versions prior to 10.6.2 Description The issue allows remote authenticated users to read arbitrary files. This is achieved by exploiting a directory traversal vulnerability in the charting component. The vulnerabilit...

Moderate: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Httpoxy Vulnerability Through CGI Servlet

twisted is vulnerable to httpoxy. The vulnerability exists because it trusts the HTTPPROXY header, and allows the configuration of proxies by setting the environment variables HTTPPROXY and HTTPSPROXY without checking if CGI is in use...

CVE-2015-8965

Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not...

Httpoxy Vulnerability Through CGI Servlet

web-core is vulnerable to a remotely exploitable vulnerability aka "httpoxy". The vulnerability exists when CGI Servlet is activated in the configuration by modifying the web.xml. It then allows the execution of a CGI script which may assign client request Proxy header values to internal HTTPPROX...

Cross-site Scripting (XSS)

sentry-provider-db is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of input sanitization in the FORMATPARAM parameter. The unsanitized parameter will be displayed in the Servlet error page, causing a reflected XSS attack...

Denial Of Service (DoS)

Glassfish is vulnerable to denial of service DoS attacks. It does not properly handle the maximum number of items allowed in the range header of the servlet request, allowing denial of service attacks...

CVE-2016-5756: Improper Neutralization of Input During Web Page Generation

Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting attacks which could be used to hijack user sessions: nps/servlet/frameservice, nps/servlet/webacc, roma/admin/cntl,...

PT-2017-8765

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.1 through 4.1.2 before Hot Fix 1 NetIQ Access Manager versions 4.2 through 4.2.2 Description The issue allows for Reflected Cross Site Scripting attacks, which could be used to hijack user sessions. The affected...

tomcat: Infinite loop in the processing of https requests

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop...

tomcat: Infinite loop in the processing of https requests

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop...