Cross site scripting

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser...

CVE-2018-1000129

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser...

CVE-2018-1000129

CVE-2018-1000129 affects Jolokia 1.3.7, where the HTTP servlet is vulnerable to cross-site scripting (XSS). An attacker can cause the browser to execute arbitrary JavaScript, potentially hijacking sessions or accessing sensitive data. The issue is documented across multiple sources (NVD and secur...

CVE-2018-1000129

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser...

CVE-2018-1000129

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser...

PT-2018-9304

Name of the Vulnerable Software and Affected Versions: Jolokia agent version 1.3.7 Description: A security issue exists that allows an attacker to execute malicious javascript in the victim's browser. This is due to an XSS vulnerability in the HTTP servlet. Recommendations: For Jolokia agent...

CVE-2018-1000129: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser...

BMC Remedy AR System Cross-Site Request Forgery Vulnerability

BMC Remedy AR System is a mobile digital enterprise management platform for IT departments from BMC Software, Inc. and Remedy Mid Tier is one of the middleware components. A cross-site request forgery vulnerability exists in Remedy Mid Tier in BMC Remedy AR System version 9.1. A remote attacker c...

CVE-2017-18228

Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet request...

PT-2018-6755

Name of the Vulnerable Software and Affected Versions: BMC Remedy AR System version 9.1 Description: The issue allows for XSS via the ATTKey parameter in an "arsys/servlet/AttachServlet" request. Recommendations: For BMC Remedy AR System version 9.1, avoid using the ATTKey parameter in the...

Cisco Security Manager Cross-Site Scripting Vulnerability

Cisco Security Manager CSM is a suite of enterprise-level management applications from Cisco that are used to configure firewall, VPN, and intrusion protection security services on Cisco network and security devices. A cross-site scripting vulnerability exists in the DesktopServlet of the Web-bas...

CVE-2018-0223

A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient validation o...

tomcat: Late application of security constraints can lead to resource exposure for unauthorised users

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that...

tomcat: Remote Code Execution via JSP Upload

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution...

tomcat: Late application of security constraints can lead to resource exposure for unauthorised users

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that...

The vulnerability of the downloadBasicSSOServlet component in the Identity Server of the authentication and access control solution from NetIQ Access Manager allows a perpetrator to execute arbitrary code.

The vulnerability of the downloadBasicSSOServlet component in the Identity Server’s authentication and access control mechanism is related to errors in managing registration data when processing the fileinfo1 parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

MGASA-2018-0149 Updated tomcat packages fix security vulnerabilities

In Tomcat 8.0.45, the description of the search algorithm used by the CGI Servlet to identify which script to execute was updated. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the...

Updated tomcat packages fix security vulnerabilities

In Tomcat 8.0.45, the description of the search algorithm used by the CGI Servlet to identify which script to execute was updated. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the...

Apache Tomcat Security Bypass Vulnerability(CVE-2018-1305)

Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.4 Apache Tomcat 8.5.0 to 8.5.27 Apache Tomcat 8.0.0.RC1 to 8.0.49 Apache Tomcat 7.0.0 to 7.0.84 Description: Security constraints defined by annotations of Servlets were only applied once a Servlet had been...

Apache Tomcat Security Bypass Vulnerability (CNVD-2018-03662)

Tomcat is developed by the Apache Software Foundation under the Jakarta project a Servlet container , in accordance with the technical specifications provided by Sun Microsystems , the realization of the Servlet and JavaServer Page JSP support , and provides a number of features specific to the W...