PT-2011-3236 · Apache +1 · Apache Tomcat +2

Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an...

PT-2011-3401

Name of the Vulnerable Software and Affected Versions IBM Rational Build Forge version 7.1.0 Description The issue allows context-dependent attackers to discover session IDs by reading web-server access logs, web-server Referer logs, or the browser history. This is due to the use of the HTTP GET...

tomcat5 security update

CentOS Errata and Security Advisory CESA-2011:0336 Updated tomcat5 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

ZDI-11-118: Novell ZENworks Asset Management Path Traversal File Overwrite Remote Code Execution Vulnerability

ZDI-11-118: Novell ZENworks Asset Management Path Traversal File Overwrite Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-118 April 11, 2011 -- CVE ID: CVE-2010-4229 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products:...

Novell ZENworks Asset Management Path Traversal File Overwrite Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENworks Asset Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within a servlet provided within the Novell Zenworks distribution for...

PT-2011-3158

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.0.0 through 7.0.11 Description The issue arises from the HTTP BIO connector in Apache Tomcat not properly handling HTTP pipelining. This allows remote attackers to potentially read responses intended for other clients ...

DSA-2207-1 tomcat5.5 - several

Bulletin has no description...

Oracle WebLogic Server Servlet Container Session Fixation

The version of Oracle WebLogic Server running on the remote host has a session fixation vulnerability. A remote attacker could exploit this by tricking a user into making a specially crafted POST request. This would allow the attacker to hijack the user's session. %NASLMINLEVEL 70300 C Tenable...

Important: Red Hat Security Advisory: tomcat5 security update

Updated tomcat5 packages that fix one security issue are now available for JBoss Enterprise Web Server 1.0. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

Important: Red Hat Security Advisory: tomcat6 security update

Updated tomcat6 packages that fix two security issues are now available for JBoss Enterprise Web Server 1.0. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, ar...

Important: Red Hat Security Advisory: tomcat5 security update

Updated tomcat5 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: tomcat6 security and bug fix update

Updated tomcat6 packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Debian Security Advisory DSA 2160-1 (tomcat6)

The remote host is missing an update to tomcat6 announced via advisory DSA 2160-1. OpenVAS Vulnerability Test $Id: deb21601.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2160-1 tomcat6 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch Advisory ID: cisco-sa-20110223-telepresence-ctms Revision 1.0 For Public Release 2011 February 23...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch Advisory ID: cisco-sa-20110223-telepresence-ctms Revision 1.0 For Public Release 2011 February 23...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server Advisory ID: cisco-sa-20110223-telepresence-ctrs Revision 1.0 For Public Release 2011 February 23 1600 UTC GMT...

Denial of Service vulnerability in Cewolf

Hello 3APA3A! I want to warn you about Denial of Service vulnerability in Cewolf - Chart Enabling Web Object Framework. This servlet is using as at individual sites, as in different CMS. Besides Cewolf itself, also those web applications are vulnerable which are using it, such as Megapolis.Portal...

CVE-2011-0384

The Java Servlet framework on Cisco TelePresence Multipoint Switch CTMS devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x does not require administrative authentication for unspecified actions, which allows remote attackers to execute arbitrary code via a crafted request, aka Bug ID CSCtf01253...

Design/Logic Flaw

The Java Servlet framework on Cisco TelePresence Multipoint Switch CTMS devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x does not require administrative authentication for unspecified actions, which allows remote attackers to execute arbitrary code via a crafted request, aka Bug ID CSCtf01253...

CVE-2011-0383

The Java Servlet framework on Cisco TelePresence Recording Server devices with software 1.6.x before 1.6.2 and Cisco TelePresence Multipoint Switch CTMS devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x does not require administrative authentication for unspecified actions, which allows remote...