Important: Red Hat Security Advisory: jbossweb security update

An updated jbossweb package that fixes one security issue is now available for Red Hat JBoss Enterprise Application Platform 6.1.0 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring...

Important: Red Hat Security Advisory: jbossweb security update

An update for Red Hat JBoss Enterprise Application Platform 6.1.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score,...

Directory traversal

Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arbitrary files via a .. dot dot in the name parameter...

CVE-2013-3597

SearchBlox is affected by CVE-2013-3597 in the servlet/CollectionListServlet prior to version 7.5 build 1. An unauthenticated remote attacker can read usernames and passwords via the getList action, compromising confidentiality. The issue is part of multiple vulnerabilities in version 7.4 and ear...

PT-2013-4503

Name of the Vulnerable Software and Affected Versions SearchBlox versions prior to 7.5 build 1 Description The issue allows remote attackers to read usernames and passwords. This is achieved through the servlet/CollectionListServlet via a getList action. Recommendations For versions prior to 7.5...

PT-2013-4504

Name of the Vulnerable Software and Affected Versions SearchBlox versions prior to 7.5 build 1 Description The issue allows remote attackers to overwrite arbitrary files via a .. dot dot in the name parameter of the servlet/CreateTemplateServlet. Recommendations For versions prior to 7.5 build 1,...

CVE-2013-3598: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arbitrary files via a .. dot dot in the name parameter...

CVE-2013-3597: Exposure of Sensitive Information to an Unauthorized Actor

servlet/CollectionListServlet in SearchBlox before 7.5 build 1 allows remote attackers to read usernames and passwords via a getList action...

CVE-2013-3016

IBM WebSphere Portal 6.1, 7.0, and 8.0 allows remote attackers to access the user directory via a crafted request for a servlet, related to the serveServletsByClassnameEnabled setting...

PT-2013-4097

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 6.1 through 8.0 Description The issue allows remote attackers to access the user directory via a crafted request for a servlet. This is related to the setting serveServletsByClassnameEnabled. Recommendations For I...

CVE-2013-3426

The Serviceability servlet on Cisco 9900 IP phones does not properly restrict paths, which allows remote attackers to read arbitrary files by specifying a pathname in a file request, aka Bug ID CSCuh52810...

Debian Security Advisory DSA 2725-1 (tomcat6 - several vulnerabilities)

Two security issues have been found in the Tomcat servlet and JSP engine: CVE-2012-3544 The input filter for chunked transfer encodings could trigger high resource consumption through malformed CRLF sequences, resulting in denial of service. CVE-2013-2067 The FormAuthenticator module was vulnerab...

DSA-2725-1 tomcat6 - several

Bulletin has no description...

CVE-2013-3426

CVE-2013-3426 affects Cisco 9900 Series IP phones: the Serviceability servlet does not properly restrict path values, enabling a remote attacker to read arbitrary files by supplying a pathname in a file request (Bug CSCuh52810). The issue is described as unauthenticated remote access with potenti...

CVE-2013-3426

The Serviceability servlet on Cisco 9900 IP phones does not properly restrict paths, which allows remote attackers to read arbitrary files by specifying a pathname in a file request, aka Bug ID CSCuh52810...

Cisco 9900 Series Phone Arbitrary File Download Vulnerability

A vulnerability in the Serviceability servlet of fourth-generation Cisco IP phones could allow an unauthenticated, remote attacker to download arbitrary files from the phone's file system. The vulnerability is due to incomplete filtering of path values. An attacker could exploit this vulnerabilit...

PT-2013-4383

Name of the Vulnerable Software and Affected Versions Cisco 9900 IP phones affected versions not specified Description The issue concerns the Serviceability servlet, which does not properly restrict paths. This allows remote attackers to read arbitrary files by specifying a pathname in a file...

CVE-2013-3426: Undefined Security Weakness

The Serviceability servlet on Cisco 9900 IP phones does not properly restrict paths, which allows remote attackers to read arbitrary files by specifying a pathname in a file request, aka Bug ID CSCuh52810...

[ANN] Struts 2.3.14.3 GA (fast-track) release available

The Apache Struts group is pleased to announce that Struts 2.3.14.3 is available as a "General Availability" release. The GA designation is our highest quality grade. Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework is designed...

[ANN] Struts 2.3.14.1 GA (fast track | security)

The Apache Struts group is pleased to announce that Struts 2.3.14.1 is available as a "General Availability" release. The GA designation is our highest quality grade. Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework is designed...