Advantech WebAccess NMS DownloadAction Servlet Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DownloadAction servlet. When parsing the filename and taskname...

PT-2018-9843

Name of the Vulnerable Software and Affected Versions: Trend Micro Endpoint Application Control version 2.0 Description: A directory traversal issue exists due to a flaw in the FileDrop servlet, allowing a remote attacker to execute arbitrary code on vulnerable installations. Authentication is...

Cisco Prime File Upload Servlet Remote Code Execution (CVE-2018-0258)

A remote code execution vulnerability has been reported in Cisco Prime File Upload Servlet. This is due to improper input validation of the parameters in the HTTP request and a processing error in the role-based access control RBAC of URLs. A remote attacker could exploit this vulnerability by...

Trend Micro Endpoint Application Control FileDrop Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Endpoint Application Control. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileDrop servlet. When parsing filenames, the process does no...

tomcat: Late application of security constraints can lead to resource exposure for unauthorised users

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that...

The vulnerability of the UploadFileOnUIServerServlet component in the HPE UCMDB database configuration units allows a attacker to execute arbitrary code.

The vulnerability of the UploadFileOnUIServerServlet component in the HPE UCMDB Universal Configuration Management Database is related to deficiencies in path name validation for restricted access directories. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code i...

Cisco Prime File Upload Servlet Path Traversal and Remote Code Execution Vulnerability

A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device and execute those files. For more information about this vulnerability per Cisco product, see the Details...

CVE-2018-0258: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device aka Path Traversal and execute those files. This vulnerability affects the following products: Cisco Prime Data...

Unrestricted file upload

Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to 1 deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or 2 possibly write to arbitrary files and cause a denial of service by uploading a...

Jfrog Artifactory < 4.16 - Arbitrary File Upload / Remote Command Execution

Exploit Title: Jfrog Artifactory alert/Vulnerable/" within the file app.html : POST /artifactory/ui/artifact/upload HTTP/1.1 Host: removed User-Agent: removed Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate...

Jfrog Artifactory 4.16 - Arbitrary File Upload Remote Command Execution

Jfrog Artifactory 4.16 - Arbitrary File Upload Remote Command Execution Exploit Title: Jfrog Artifactory alert/Vulnerable/" within the file app.html : POST /artifactory/ui/artifact/upload HTTP/1.1 Host: removed User-Agent: removed Accept:...

undertow: Path traversal in ServletResourceManager class

A path traversal vulnerability was discovered in Undertow's org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method. This could lead to information disclosure of arbitrary local files...

undertow: Path traversal in ServletResourceManager class

A path traversal vulnerability was discovered in Undertow's org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method. This could lead to information disclosure of arbitrary local files...

jira2.salt-solutions.de XSS vulnerability

Open Bug Bounty ID: OBB-604416 Description| Value ---|--- Affected Website:| jira2.salt-solutions.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-7660

In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Reflected Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via the servlet/Download docbase or username parameter...

CVE-2018-7660: Improper Neutralization of Input During Web Page Generation

In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Reflected Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via the servlet/Download docbase or username parameter...

PT-2018-18191

Name of the Vulnerable Software and Affected Versions OpenText Documentum D2 Webtop version 4.6.0030 build 059 Description A Reflected Cross-Site Scripting issue could potentially be exploited by malicious users to compromise the affected system. The issue is related to the servlet/Download,...

[SECURITY] Fedora 27 Update: tomcat-8.0.50-1.fc27

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

[SECURITY] Fedora 26 Update: tomcat-8.0.50-1.fc26

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

openSUSE Security Update : tomcat (openSUSE-2018-325)

This update for tomcat fixes the following issues : Security issues fixed : - CVE-2018-1305: Fixed late application of security constraints that can lead to resource exposure for unauthorised users bsc1082481. - CVE-2018-1304: Fixed incorrect handling of empty string URL in security constraints...