CVE-2022-37312

OX App Suite up to version 7.10.6 is affected by an Uncontrolled Resource Consumption vulnerability triggered by a large request body containing a redirect URL to the deferrer servlet. Reported impact: memory/resource exhaustion with availability impact. Public remediation guidance varies: PT Sec...

CVE-2022-37311: Improper Validation of Specified Quantity in Input

OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet...

CVE-2020-24600

CVE-2020-24600 affects Shilpi CAPExWeb 1.1. It enables SQL injection via the servlet capexweb.cap_sendMail when a GET parameter is used, with CVSS v3.1 base score 9.8 (CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Impacts include confidentiality, integrity, and availability. The vulnerability i...

OESA-2022-2149 jetty security update

%global desc \ Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\ do not need to configure and run a separate web server like Apache in order\ to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\ featured web server for static and dynamic content...

IBM Navigator for i Unauthorized Access Vulnerability

IBM Navigator for i is a console interface from International Business Machines IBM used in IBMi to perform and manage critical tasks in IBMi. IBM Navigator for i in versions 7.3, 7.4, and 7.5 is vulnerable to unauthorized access, where authenticated users using this interface access their entitl...

CVE-2022-43857

IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks and download log files by modifying servlet filter. IBM X-Force I...

CVE-2022-43857

IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks and download log files by modifying servlet filter. IBM X-Force I...

Design/Logic Flaw

IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks and download log files by modifying servlet filter. IBM X-Force I...

CVE-2022-43857 IBM Navigator for i information disclosure

IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks and download log files by modifying servlet filter. IBM X-Force I...

CVE-2022-43857

IBM Navigator for i versions 7.3–7.5 is vulnerable to an information-disclosure issue where an authenticated user can bypass interface checks and download log files by modifying the servlet filter. Affected products: IBM Navigator for i 7.3/7.4/7.5. Root cause: bypass of interface checks via serv...

PT-2022-27034 · Ibm · Ibm Navigator For I

Name of the Vulnerable Software and Affected Versions: IBM Navigator for i versions 7.3 through 7.5 Description: The issue allows an authenticated user to access IBM Navigator for i log files they are authorized to, but not while using this interface. The remote authenticated user can bypass the...

CVE-2022-43857: Improper Limitation of a Pathname to a Restricted Directory

IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks and download log files by modifying servlet filter. IBM X-Force I...

IBM Navigator for i 路径遍历漏洞

IBM Navigator for i is a console interface from International Business Machines IBM used in IBMi to perform and manage critical tasks in IBMi. IBM Navigator for i in versions 7.3, 7.4, and 7.5 is vulnerable to unauthorized access, where authenticated users using this interface access their entitl...

OESA-2022-2140 jetty security update

%global desc \ Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\ do not need to configure and run a separate web server like Apache in order\ to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\ featured web server for static and dynamic content...

PT-2022-27839 · Apache · Apache Cxf

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.4.10 Apache CXF versions prior to 3.5.5 Description: A vulnerability in Apache CXF allows an attacker to perform a remote directory listing or code exfiltration. This issue arises when the CXFServlet is configur...

Design/Logic Flaw

Improper neutralization of special elements used in an LDAP query 'LDAP Injection' vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries DoS, additional queries, filter manipulation during...

CVE-2022-45910 Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities

Improper neutralization of special elements used in an LDAP query 'LDAP Injection' vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries DoS, additional queries, filter manipulation during...

CVE-2022-45910

Improper neutralization of special elements used in an LDAP query 'LDAP Injection' vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries DoS, additional queries, filter manipulation during...

PT-2022-27680 · Apache · Apache Manifoldcf

Name of the Vulnerable Software and Affected Versions: Apache ManifoldCF versions 2.23 and prior versions Description: The issue is related to improper neutralization of special elements used in an LDAP query, also known as 'LDAP Injection'. This allows an attacker to manipulate the LDAP search...

CVE-2022-45910: Improper Neutralization of Special Elements used in an LDAP Query

Improper neutralization of special elements used in an LDAP query 'LDAP Injection' vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries DoS, additional queries, filter manipulation during...