Improper Restriction of XML External Entity Reference in bedework:bw-webdav

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java...

jolokia: Cross site scripting in the HTTP servlet

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser...

XML External Entity (XXE)

bw-webdav is vulnerable to XML external entities attacks XXE. The parseContent function in webdav/servlet/common/MethodBase.java and the processXML function in webdav/servlet/common/PostRequestPars.java do not implement secure XML parsing which would allow a remote attacker to perform XXE attacks...

Design/Logic Flaw

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java...

CVE-2018-20000

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java...

Advantech WebAccess NMS DownloadAction Directory Traversal (CVE-2018-7503)

A directory traversal vulnerability exists in Advantech WebAccess NMS. The vulnerability is due to insufficient input validation on file paths in the DownloadAction servlet...

Virtuozzo 6 : tomcat6 / tomcat6-admin-webapps / etc (VZLSA-2017-3080)

An update for tomcat6 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Security Bulletin: Security vulnerability related to Java SE (JDK) version 6 has been identified in the WebSphere Application Server where the Rational Asset Manager is deployed

Summary The Java SE JDK version 6.0 running on IBM WebSphere Application Server could allow a remote attacker to utilize the FormLogout servlet for redirecting to unauthorized hosts. This vulnerability can result in exploiting the WebSphere Application Server for potential spoofing. Vulnerability...

Atlassian Jira Authenticated Upload Code Execution Exploit

This Metasploit module can be used to execute a payload on Atlassian Jira via the Universal Plugin ManagerUPM. The module requires valid login credentials to an account that has access to the plugin manager. The payload is uploaded as a JAR archive containing a servlet using a POST request agains...

Atlassian Jira Authenticated Upload Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Atlassian Jira Authenticated Upload Code Execution', 'Description' = %q This module can be used to execute a payload on Atlassian Jira via the...

Cross-Site Scripting (XSS)

Mortbay Jetty test web-app is vulnerable to cross-site scripting. The Dump Servlet does not output-sanitise before displaying on a user's browser. This allows a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc0) +22 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.0.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc1) +22 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.0.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc6), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc6) +32 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.0.0.rc6)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc6 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc6 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.1.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.1.0.rc1) +33 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.1.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.1.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.5.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (7.5.0.rc2) +43 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.5.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 7.5.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.5.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

org.cometd.java:cometd-java-examples (2.4.0.rc3), org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc5) +46 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-java-examples 2.4.0.rc3 - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc...

com.hazelcast:hazelcast-jetty7-sessionmanager (>=1.0, <=1.0.2), org.akhikhl.gretty:gretty-runner-jetty7 (>=1.1.9, <=2.0.0) +52 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.16.v20140903)

org.eclipse.jetty:jetty-server MAVEN version 7.6.16.v20140903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.hazelcast:hazelcast-jetty7-sessionmanager =1.0, =1.1.9, =1.4.10, =1.4.14 -...

org.eclipse.jetty.aggregate:jetty-all (7.6.20.v20160902), org.eclipse.jetty.aggregate:jetty-all-server (7.6.20.v20160902) +36 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.20.v20160902)

org.eclipse.jetty:jetty-server MAVEN version 7.6.20.v20160902 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.20.v20160902 -...

org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc5), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc5) +43 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (8.1.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 8.1.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc5 - org.eclipse.jetty.aggregate:jetty-all-server...