PT-2016-1755

Name of the Vulnerable Software and Affected Versions EMC Unisphere for VMAX Virtual Appliance versions prior to 8.2.0 Description The issue is related to an HTTP servlet in the vApp Manager component, which lacks sufficient input validation. This allows remote attackers to modify arbitrary files...

CVE-2015-5348: Undefined Security Weakness

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

PT-2016-3685

Name of the Vulnerable Software and Affected Versions Apache Camel versions 2.6.x through 2.14.x Apache Camel versions 2.15.x before 2.15.5 Apache Camel versions 2.16.x before 2.16.1 Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object i...

DotCMS 3.5 Beta Directory Traversal

Advisory: DotCMS Directory traversal vulnerability Author: Piaox From Pingan Product Safety Group Email: [email protected] Affected Version: dotCMS 3.5 Betathe latest version ========================== Vulnerability Description Recetly, I found a Directory traversal vulnerability in...

CVE-2016-3975: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter to irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, aka SAP...

Design/Logic Flaw

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

CVE-2016-0793

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

CVE-2016-0793

CVE-2016-0793 affects WildFly (formerly JBoss AS) on Windows, where an incomplete blacklist in the servlet filter restriction mechanism lets remote attackers read sensitive files from WEB-INF or META-INF via requests containing lowercase or meaningless characters. The issue is tied to WildFly ver...

CVE-2016-0793

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

CVE-2016-0793

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

CVE-2016-0793: Exposure of Sensitive Information to an Unauthorized Actor

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

PT-2016-1632

Name of the Vulnerable Software and Affected Versions WildFly versions prior to 10.0.0.Final Description The issue is related to an incomplete blacklist vulnerability in the servlet filter restriction mechanism. This allows remote attackers to read sensitive files in the WEB-INF or META-INF...

[SECURITY] Fedora 22 Update: tomcat-7.0.68-3.fc22

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

VulnCheck KEV: CVE-2013-4810

HP ProCurve Manager PCM, PCM+, Identity Driven Manager IDM, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to 1 EJBInvokerServlet or 2 JMXInvokerServlet...

Debian Security Advisory DSA 3530-1 (tomcat6 - security update)

Multiple security vulnerabilities have been fixed in the Tomcat servlet and JSP engine, which may result on bypass of security manager restrictions, information disclosure, denial of service or session fixation. OpenVAS Vulnerability Test $Id: deb3530.nasl 6608 2017-07-07 12:05:05Z cfischer $...

用友IUFO远程命令执行(cloudeye演示)

简要描述： 用友IUFO远程命令执行 详细说明： google:inurl:/service/iufo 这个只是其中的一条线索，当然这个已经搜出来10几页以上的站点 应用的使用量比较大，部署采用WebSphere 代码分析: web.xml: NCInvokerServlet nc.bs.framework.server.InvokerServlet NCFindWebServlet nc.bs.framework.server.FindWebResourceServlet NCFindWebServlet /NCFindWeb CommonServletDispatcher...

CentOS 6 : tomcat6 (CESA-2016:0492)

Updated tomcat6 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

TRS(ids新老版本)设计缺陷(xxe/用户信息泄露包括密码等)

简要描述： TRSids设计缺陷xxe/用户信息泄露包括密码，好久没有发过漏洞了，突然上来看了看，发现漏洞提交页面都变了 详细说明： 首先我们看看web.xml配置文件: ServiceServlet com.trs.idm.admin.service.ServiceServlet ServiceServlet /service 跟进ServiceServlet protected void serviceHttpServletRequest request, HttpServletResponse response throws ServletException, IOExceptio...

CentOS Update for tomcat6 CESA-2016:0492 centos6

Check the version of tomcat6 SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882434";...

Debian: Security Advisory (DSA-3530-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...