Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

UberFire: Information disclosure and RCE via insecure file upload/download servlets

It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gai...

Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs

It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities XXEs in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive informati...

ManageEngine OpManager Multiple Directory Traversal Vulnerabilities

The version of ManageEngine OpManager installed on the remote host is affected by multiple directory traversal vulnerabilities : - The FileCollector servlet fails to properly sanitize user-supplied input to the 'regionID' and 'FILENAME' parameters when uploading files. This allows a remote attack...

Design/Logic Flaw

ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a 1 getTicketData action to servlet/AJaxServlet or a direct request to 2 swf/flashreport.swf, 3 reports/flash/details.jsp, or 4 reports/CreateReportTable.jsp...

PT-2015-5316

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus versions prior to 9.0 build 9031 Description The issue allows remote authenticated users to obtain sensitive ticket information. This can be achieved through various means, including a getTicketData action to the...

Hewlett-Packard UCMDB 10.10 JMX-Console Authentication Bypass Vulnerability

Hewlett-Packard Universal CMDB version 10.10 suffers from a jmx-console related authentication bypass vulnerability. Title: Hewlett-Packard UCMDB - JMX-Console Authentication Bypass CVE-ID: CVE-2014-7883 Product: Hewlett-Packard Universal CMDB UCMDB Affected versions: UCMDB 10.10 Other versions...

释锐教育校校用平台通用远程命令执行

简要描述： 释锐教育校校用平台通用远程命令执行，可批量getshell. 详细说明： 一、 上海释锐网络信息服务有限公司成立于2002年，是一家注册并入住张江高科技园区的教育软件企业。 释锐™致力于传播教育先进力量，为教育行业用户提供从校校用™软件及服务、910SPACE.COM教育社区网站运营到教育论坛与咨询服务等全方位的教育信息化应用解决方案，通过教育信带动推动教育现代化。 荣誉与市场地位： 1.“释锐®校校用™平台”2004荣获“上海市中小学教育信息化应用示范项目”。 2.“释锐®校校用™平台”2008荣获“上海市张江高科技园区科技创新专项资金政府资助项目”。...

Oracle Secure Global Desktop Multiple Vulnerabilities (January 2015 CPU) (POODLE)

The remote host has a version of Oracle Secure Global Desktop that is version 4.63, 4.71, 5.0 or 5.1. It is, therefore, affected by multiple vulnerabilities in the following components : - Apache HTTP Server - Client - Gateway JARP module - Gateway Reverse Proxy - OpenSSL - Print Servlet only in...

Lexmark MarkVision Enterprise - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Lexmark MarkVision Enterprise Arbitrary File Upload', 'Description' = %q This module exploits a code execution flaw in Lexmark...

[ANN] Apache Struts 2.3.20 GA release available with security fix

The Apache Struts group is pleased to announce that Apache Struts 2.3.20 is available as a "General Availability" release. The GA designation is our highest quality grade. Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework is...

IBM WebSphere Application Server Liberty Profile Elevation of Privilege Vulnerability

IBM WebSphere Application Server is developed by IBM in accordance with open standards and issued an application server. An elevation of privilege vulnerability in IBM WebSphere Application Server Liberty Profile version 8.5.x prior to 8.5.5.4 allows remote attackers to gain privileges by...

Xxe

nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, relat...

CVE-2014-9412

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter to roma/jsp/debug/debug.jsp or 2 an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a...

PT-2014-6350

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager NAM versions 4.0.0 through 4.0.1 before HF3 Description The issue allows remote authenticated users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity...

PT-2014-6353

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager NAM versions 4.0 through 4.1 Description A cross-site request forgery CSRF issue exists in the Administration Console server, specifically in the nps/servlet/webacc component. This allows remote attackers to hijack the...

CVE-2014-5217: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...

CVE-2014-8890

IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations...

Design/Logic Flaw

IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations...

CVE-2014-8890

CVE-2014-8890 affects IBM WebSphere Application Server Liberty Profile (8.5.x) where a remote attacker can gain elevated privileges when deployment-descriptor security constraints are combined with ServletSecurity annotations. Root cause: improper handling of security configuration in the servlet...