CVE-2009-5048

CVE-2009-5048 is a stored XSS in the Jetty project, specifically the Cookie Dump Servlet, affecting Jetty 6.1.x up to 6.1.20. The root cause is improper validation of user-supplied input in the Cookie Dump Servlet, enabling an attacker to inject script that could access cookie-based credentials. ...

CVE-2009-5048

Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20...

CVE-2009-5048: Improper Neutralization of Input During Web Page Generation

Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20...

CVE-2009-5046: Improper Neutralization of Input During Web Page Generation

JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22...

CVE-2009-5045: Exposure of Sensitive Information to an Unauthorized Actor

Dump Servlet information leak in jetty before 6.1.22...

PT-2019-6516

Name of the Vulnerable Software and Affected Versions jetty versions prior to 6.1.22 Description The issue concerns a JSP Dump and Session Dump Servlet XSS in jetty. Recommendations For versions prior to 6.1.22, update to version 6.1.22 or later to resolve the issue...

PT-2019-6518

Name of the Vulnerable Software and Affected Versions jetty versions prior to 6.1.21 Description The issue is related to a stored XSS vulnerability in the Cookie Dump Servlet. Recommendations For versions prior to 6.1.21, update to version 6.1.21 or later to resolve the issue...

PT-2019-6515

Name of the Vulnerable Software and Affected Versions jetty versions prior to 6.1.22 Description The issue is related to a Dump Servlet information leak in jetty. Recommendations For versions prior to 6.1.22, update to version 6.1.22 or later to resolve the issue...

CVE-2018-11784

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of the...

CVE-2019-16908

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14J8 for Jira. It is possible to obtain a list of all Jira projects without authentication/authorization via the plugins/servlet/nfj/ProjectFilter?searchQuery= URI...

CVE-2019-16909: Missing Authorization

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14J8 for Jira. It is possible to obtain a list of all Jira projects with authentication as a Jira user, but without authorization for specific projects via the plugins/servlet/nfj/NotificationSettings URI...

CVE-2019-16908: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14J8 for Jira. It is possible to obtain a list of all Jira projects without authentication/authorization via the plugins/servlet/nfj/ProjectFilter?searchQuery= URI...

PT-2019-14859

Name of the Vulnerable Software and Affected Versions Infosysta In-App & Desktop Notifications app versions prior to 1.6.14 J8 for Jira Description An issue allows obtaining a list of all Jira projects without proper authentication or authorization. This can be achieved via the...

Ignite Realtime Openfire Server-Side Request Forgery Vulnerability

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A server-side request forgery SSRF vulnerability exists in FaviconServlet.java in Ignite Realtime Openfire 4.4.2 and earlier versions. An attacker can exploit this vulnerability to send...

CVE-2019-4409: Improper Neutralization of Input During Web Page Generation

HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the...

CVE-2019-17602

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

CVE-2017-12615

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. Mitigation Ensure that readonly is set to true the default for the...

PT-2019-5531 · Ignite Realtime · Openfire

Name of the Vulnerable Software and Affected Versions: Openfire versions through 4.4.2 Description: A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java allows attackers to send arbitrary HTTP GET requests. The issue is related to insufficient validation of incoming requests,...

Publisure Improper Access Control Vulnerability

Publisure is an integrated multi-channel communications platform for outbound communications. An improper access control vulnerability exists in the servletcontroller in the secure portal of Publisure 2.1.2, which can be exploited by an attacker to bypass authentication and execute queries agains...

PT-2019-13562

Name of the Vulnerable Software and Affected Versions Publisure version 2.1.2 Description An issue in the servlet controller of the secure portal allows authentication bypass, enabling unauthorized queries on PHP forms within the /AdminDir folder, which should be restricted. Recommendations For...