CVE-2003-0628

This CVE affects the PeopleSoft Gateway Administration servlet (gateway.administration) in PeopleTools 8.43 and earlier. An attacker can disclose the full pathnames of server-side include (SSI) files by sending an HTTP request with an invalid value, a path-disclosure vulnerability impacting confi...

CVE-2003-0950

CVE-2003-0950 affects PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x. The issue allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the directory name (based on system time) used to store the file, and directly requesting that file. The underlyi...

ISS Security Brief: PeopleSoft IClient Servlet Remote Command Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Brief November 12, 2003 PeopleSoft IClient Servlet Remote Command Execution Vulnerability Synopsis: ISS X-Force has discovered a flaw in a servlet that is part of the PeopleSoft PeopleTools application framework. PeopleSoft...

security flaw

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

CVE-2002-0569

Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet XSQLServlet...

CVE-2002-0569

CVE-2002-0569 affects Oracle 9i Application Server via the XSQLServlet, enabling remote authentication bypass to access configuration files. The core issue is bypassing access restrictions on configuration files through direct requests to XSQLServlet, leading to potential exposure of sensitive fi...

CVE-2002-0300

gnujsp 1.0.0 and 1.0.1 allows remote attackers to list directories, read source code of certain scripts, and bypass access restrictions by directly requesting the target file from the gnujsp servlet, which does not work around a limitation of JServ and does not process the requested file...

CVE-2002-1533

The CVE-2002-1533 entry describes a cross-site scripting (XSS) vulnerability in the Jetty JSP servlet engine. An attacker can inject arbitrary HTML or script by constructing an HTTP request to a .jsp file whose name contains the malicious script and encoded linefeed characters (%0a). Affected sof...

S21SEC-011 - Multiple vulnerabilities in BEA WebLogic Server

ID: S21SEC-011-en Title: Multiple vulnerabilities in BEA WebLogic Server Date: 7/01/2003 Status: Patch published Scope: Remote command execution Platforms: Linux, Windows 2000, probably others Author: llmora Location: http://www.s21sec.com/en/avisos/s21sec-011-en.txt Release: Public S 2 1 S E C...

security flaw

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

CVE-2002-2142

An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper...

security flaw

The default servlet org.apache.catalina.servlets.DefaultServlet in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet...

security flaw

The default servlet org.apache.catalina.servlets.DefaultServlet in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet...

wp-02-0011: Jetty CGIServlet Arbitrary Command Execution

Westpoint Security Advisory Title: Jetty CGIServlet Arbitrary Command Execution Risk Rating: Medium Software: Jetty Servlet Container Platforms: Win32 other platforms not tested Vendor URL: www.mortbay.org Author: Matt Moore [email protected] Date: 1st October 2002 Advisory ID: wp-02-0011.txt...

Jetty 4.1 Servlet Engine - Cross-Site Scripting

Jetty 4.1 Servlet Engine - Cross-Site Scripting source: https://www.securityfocus.com/bid/5821/info Jetty is a freely available, open source Java Web Server and Servlet Container. It is available for Linux, Unix, and Microsoft Windows platforms. It has been reported that Jetty does not properly...

Crossite scripting in Apache Tomcat

It's posible to insert script in request to different servlett classes...

Apache Tomcat 4.1 - JSP Request Cross-Site Scripting

Apache Tomcat 4.1 - JSP Request Cross-Site Scripting source: https://www.securityfocus.com/bid/5542/info Jakarta Tomcat is a Java Servlet and JSP server produced by the Apache Software Foundation. Tomcat is available for Microsoft Windows, Linux, and other Unix based operating systems. A cross si...

Apache Tomcat TroubleShooter Servlet Information Disclosure

The default installation of Apache Tomcat includes various sample JSP pages and servlets. One of these, the 'TroubleShooter' servlet, discloses Tomcat's installation directory when accessed directly. %NASLMINLEVEL 70300 This script was written by Matt Moore Script audit and contributions from...

Apache Tomcat 4.0.3 - Servlet Mapping Cross-Site Scripting

Apache Tomcat 4.0.3 - Servlet Mapping Cross-Site Scripting source: https://www.securityfocus.com/bid/5193/info A vulnerability has been reported for Apache Tomcat 4.0.3 on Microsoft Windows and Linux platforms. Reportedly, it is possible for an attacker to launch a cross site scripting attack. Wh...