Cross site scripting

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...

UBUNTU-CVE-2018-8032

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...

DEBIAN-CVE-2018-8032

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...

CVE-2018-8032

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...

CVE-2018-8032

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...

CVE-2018-8032

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...

CVE-2018-8032: Improper Neutralization of Input During Web Page Generation

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...

Code injection

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

CVE-2017-2589

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

CVE-2017-2589

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

CVE-2017-2589

The vulnerability CVE-2017-2589 affects hawtio servlet 1.4, where a single HttpClient instance proxies requests with a persistent cookie store, causing cookies to be stored locally and shared across all proxy clients. As a result, all users of the proxy share the same cookies, potentially exposin...

CVE-2017-2589: Improper Authorization

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

PT-2018-7119

Name of the Vulnerable Software and Affected Versions: hawtio servlet version 1.4 Description: A issue was found where the hawtio servlet uses a single HttpClient instance to proxy requests, resulting in all clients sharing the same cookies due to a persistent cookie store. This means cookies are...

PT-2018-11405 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.4 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. Successful exploitation could lead to sensitive information disclosure. The SSRF vulnerability can be...

Trend Micro Endpoint Application Control FileDrop Servlet File Upload

File upload vulnerability in Trend Micro Endpoint Application Control FileDrop Servlet Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine Exchange Reporter Plus Remote Code Execution Vulnerability

ManageEngine Exchange Reporter Plus is a Web-based analysis and reporting solution for Microsoft Exchange Server. ManageEngine Exchange Reporter Plus =5310 has a remote code execution vulnerability in its implementation. The vulnerability stems from the Java servlet 'ADSHACluster' when executing...

SearchBlox Cross-Site Request Forgery Vulnerability (CNVD-2018-13281)

SearchBlox is the U.S. SearchBlox company a set of open source and free of charge based on Lucene full-text search engine toolkit to build enterprise search and analytics solutions. The program provides a Web-based management interface , you can manage the entire search system . A cross-site...

[SECURITY] Fedora 28 Update: jetty-9.4.11-2.v20180605.fc28

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in ord er to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

[SECURITY] Fedora 27 Update: jetty-9.4.11-2.v20180605.fc27

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in ord er to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

Manage Engine Exchange Reporter Plus Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Manage Engine Exchange Reporter Plus Unauthenticated RCE', 'Description' = %q This module exploits a remote code execution vulnerability that...