2738 matches found
Code injection
Unspecified vulnerability in the Servlet Engine/Web Container in IBM WebSphere Application Server WAS before 6.1.0.7 has unknown impact and attack vectors...
CVE-2007-1945
Unspecified vulnerability in the Servlet Engine/Web Container in IBM WebSphere Application Server WAS before 6.1.0.7 has unknown impact and attack vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in servlet/Spy in Dynamic Monitoring Services DMS in Oracle Application Server OAS 10g 10.1.2.0.0 allows remote attackers to inject arbitrary web script or HTML via the table parameter. NOTE: This may be related to CVE-2002-0563...
Oracle 10g Dynamic Monitoring Services XSS /servlet/Spy
Hi, Access to http://somesite/servlet/Spy should be restricted. But generally database or system administrators ignore the hardening of Oracle apllications or database. I have noticed XSS bug in Dynamic Monitoring services on Oracle-Application-Server-10g/10.1.2.0.0...
Oracle Dynamic Monitoring Services crossite scripting
Crossite scripting with /servlet/Spy...
CVE-2007-1504
Cross-site scripting XSS vulnerability in the Servlet Service in Fujitsu Interstage Application Server IJServer 8.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving web.xml and HTTP 404 and 500 status codes...
Design/Logic Flaw
Getahead Direct Web Remoting DWR before 1.1.4 allows attackers to cause a denial of service memory exhaustion and servlet outage via unknown vectors related to a large number of calls in a batch...
CVE-2007-0185
DWR (Getahead Direct Web Remoting) before version 1.1.4 is vulnerable to denial of service due to memory exhaustion triggered by a large number of batched calls; the specific vectors are not detailed in the provided documents. No remediation details are present here.
Hacking AJAX DWR Applications
By Guy Karlebach & Amichai Shulman Introduction The introduction of AJAX into a web application improves the user experience significantly. However, the complexity of some AJAX frameworks and the limited field experience with them requires a careful examination of potential vulnerabilities. DWR i...
CVE-2006-6637
The Servlet Engine and Web Container in IBM WebSphere Application Server WAS before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."...
CVE-2006-6637
The CVE-2006-6637 entry applies to IBM WebSphere Application Server (WAS) 6.0.x prior to 6.0.2.17, where enabling fileServingEnabled via ibm-web-ext.xmi and enabling servlet caching allows remote attackers to obtain JSP source code and other sensitive information through specific requests. Connec...
JBoss JMX Console Unrestricted Access
The remote web server appears to be a version of JBoss that allows unauthenticated access to the JMX and/or Web Console servlets used to manage JBoss and its services. A remote attacker can leverage this issue to disclose sensitive information about the affected application or even take control o...
IBM WebSphere snoopservlet Path Disclosure
This script attempts to enumerate the actual physical path of the servlet classes by requesting a version of 'snoopservlet' which is missing required classes. An attacker, gaining information about the actual physical layout of the file system, can use the information in crafting more complex...
CVE-2006-4956
Cross-site scripting XSS vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the inname parameter, as used by the Name field...
CVE-2006-4956
Neon WebMail for Java before 5.08 has a cross-site scripting (XSS) vulnerability in the updateuser servlet. The in_name parameter used for the Name field can be exploited to inject arbitrary script/HTML when the page is rendered. The flaw is documented under CVE-2006-4956 with consistent vendor r...
CVE-2006-4953
Neon WebMail for Java before 5.08 is affected by multiple SQL injection vulnerabilities. The issues enable remote attackers to execute arbitrary SQL commands via parameters in two servlets: (1) addrlist (adr_sortkey and adr_sortkey_desc) and (2) maillist (sortkey and sortkey_desc). Root cause is ...
CVE-2006-4956
Cross-site scripting XSS vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the inname parameter, as used by the Name field...
CVE-2006-4954
The CVE relates to the updateuser servlet in Neon WebMail for Java prior to 5.08, which does not validate the in_id parameter. This vulnerability allows remote attackers to modify information of arbitrary users (e.g., passwords, permissions, profile settings, and creating/deleting users). The iss...
