BEA WebLogic Management Servlet Multiple Vulnerabilities (BEA03-28)

BEA WebLogic is prone to multiple vulnerabilities in a management servlet. SPDX-FileCopyrightText: 2005 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2005-3164

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when...

JVN#79314822: Tomcat vulnerable in request processing

Apache Tomcat, an implementation of the Java Servlet and JavaServer Pages technologies, contains a vulnerability in processing specific requests. The Apache Software Foundation currently does not support AJP 1.3 Connector, and recommends the use of Coyote JK Connector instead. It also recommends...

CVE-2002-1895

The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service crash via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN...

CVE-2004-2105

The webacc servlet in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to read arbitrary .htt files via a full pathname in the error parameter...

CVE-2002-1640

Multiple cross-site scripting XSS vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via 1 Text Features in the DHTML UI or 2 the test parameter to the oracle.apps.cz.servlet.UiServlet servlet...

CVE-2004-2103

Cross-site scripting XSS vulnerability in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to process arbitrary script or HTML as other users via 1 a malformed request for a Perl program with script in the filename, 2 the User.id parameter to the webacc servlet, 3 the...

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

CVE-2003-0104

Directory traversal vulnerability in PeopleTools 8.10 through 8.18, 8.40, and 8.41 allows remote attackers to overwrite arbitrary files via the SchedulerTransfer servlet...

CVE-2002-1148

CVE-2002-1148 refers to a vulnerability in Apache Tomcat where the default servlet (org.apache.catalina.servlets.DefaultServlet) on Tomcat 4.0.4, 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. Connected sources (GHSA and OSS/ID...

CVE-2003-0104

CVE-2003-0104 : Affected software are PeopleTools 8.10–8.18, 8.40, and 8.41. The issue is a directory traversal in the SchedulerTransfer servlet that allows remote attackers to overwrite arbitrary files. The connected documents confirm the vulnerable component and the impact, but do not provide e...

WebLogic Internal Management Servlet Authentication Bypass

Binary data 1455.prm...

Apache Tomcat < 3.3.1a Servlet Engine MS/DOS Device Name DoS

Binary data 1467.pasl...

Apache Tomcat Snoop Servlet Remote Information Disclosure

Binary data 1464.prm...

thttpd < 2.20 ssi Servlet Traversal File Access

Binary data 1468.prm...

Character not allowed in user name

A user has sign up with the user name "m&m". The i tried to modify this user. Because the username is passed as url parameter FooServlet?name=m&m : GET or POST method the servlet container cut the name and try to retreive the username named "m" !!! The only way is to use a database client, change...

Character not allowed in user name

A user has sign up with the user name "m&m". The i tried to modify this user. Because the username is passed as url parameter FooServlet?name=m&m : GET or POST method the servlet container cut the name and try to retreive the username named "m" !!! The only way is to use a database client, change...

Character not allowed in user name

A user has sign up with the user name "m&m". The i tried to modify this user. Because the username is passed as url parameter FooServlet?name=m&m : GET or POST method the servlet container cut the name and try to retreive the username named "m" !!! The only way is to use a database client, change...

Novell Groupwise Servlet Manager Default Password

The Novell Groupwise servlet server is configured with a default password. As a result, users could be denied access to mail and other servlet based resources. To test this finding: https:///servlet/ServletManager/ enter 'servlet' for the user and 'manager' for the password. This script was writt...

Resin Status Page Information Disclosure

Requesting the URI '/caucho-status' or '/server-status' gives information about the currently running Resin java servlet container. %NASLMINLEVEL 70300 This script was written by Vincent Renardias Licence : GPL v2 Changes by Tenable: - Revised plugin title, family change 4/2/2009...