3133 matches found
CVE-2007-0185
DWR (Getahead Direct Web Remoting) before version 1.1.4 is vulnerable to denial of service due to memory exhaustion triggered by a large number of batched calls; the specific vectors are not detailed in the provided documents. No remediation details are present here.
CVE-2007-0185: Undefined Security Weakness
Getahead Direct Web Remoting DWR before 1.1.4 allows attackers to cause a denial of service memory exhaustion and servlet outage via unknown vectors related to a large number of calls in a batch...
Hacking AJAX DWR Applications
By Guy Karlebach & Amichai Shulman Introduction The introduction of AJAX into a web application improves the user experience significantly. However, the complexity of some AJAX frameworks and the limited field experience with them requires a careful examination of potential vulnerabilities. DWR i...
CVE-2006-6637
The Servlet Engine and Web Container in IBM WebSphere Application Server WAS before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."...
CVE-2006-6637
The CVE-2006-6637 entry applies to IBM WebSphere Application Server (WAS) 6.0.x prior to 6.0.2.17, where enabling fileServingEnabled via ibm-web-ext.xmi and enabling servlet caching allows remote attackers to obtain JSP source code and other sensitive information through specific requests. Connec...
CVE-2006-6637: Exposure of Sensitive Information to an Unauthorized Actor
The Servlet Engine and Web Container in IBM WebSphere Application Server WAS before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."...
JBoss JMX Console Unrestricted Access
The remote web server appears to be a version of JBoss that allows unauthenticated access to the JMX and/or Web Console servlets used to manage JBoss and its services. A remote attacker can leverage this issue to disclose sensitive information about the affected application or even take control o...
IBM WebSphere snoopservlet Path Disclosure
This script attempts to enumerate the actual physical path of the servlet classes by requesting a version of 'snoopservlet' which is missing required classes. An attacker, gaining information about the actual physical layout of the file system, can use the information in crafting more complex...
CVE-2006-4956
Cross-site scripting XSS vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the inname parameter, as used by the Name field...
CVE-2006-4956
Neon WebMail for Java before 5.08 has a cross-site scripting (XSS) vulnerability in the updateuser servlet. The in_name parameter used for the Name field can be exploited to inject arbitrary script/HTML when the page is rendered. The flaw is documented under CVE-2006-4956 with consistent vendor r...
CVE-2006-4953
Neon WebMail for Java before 5.08 is affected by multiple SQL injection vulnerabilities. The issues enable remote attackers to execute arbitrary SQL commands via parameters in two servlets: (1) addrlist (adr_sortkey and adr_sortkey_desc) and (2) maillist (sortkey and sortkey_desc). Root cause is ...
CVE-2006-4954
The CVE relates to the updateuser servlet in Neon WebMail for Java prior to 5.08, which does not validate the in_id parameter. This vulnerability allows remote attackers to modify information of arbitrary users (e.g., passwords, permissions, profile settings, and creating/deleting users). The iss...
CVE-2006-4956
Cross-site scripting XSS vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the inname parameter, as used by the Name field...
CVE-2006-4955: Undefined Security Weakness
Directory traversal vulnerability in the downloadfile servlet in Neon WebMail for Java before 5.08 allows remote attackers to read arbitrary files via a .. dot dot sequence in the 1 savefolder and 2 savefilename parameters...
CVE-2006-4954: Undefined Security Weakness
The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the inid parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying 1 passwords and 2 permissions, 3 viewing profile settings, and 4 creating and 5 deleting users...
CVE-2006-4952: Undefined Security Weakness
The updatemail servlet in Neon WebMail for Java before 5.08 allows remote attackers to move e-mail messages of arbitrary users between different mail folders, specified by the folderid and tofolderid parameters, via the ID parameter...
CVE-2006-4953: Undefined Security Weakness
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the 1 adrsortkey and 2 adrsortkeydesc parameters in the a addrlist servlet, and the 3 sortkey and 4 sortkeydesc parameters in the b maillist servlet...
CVE-2006-4956: Undefined Security Weakness
Cross-site scripting XSS vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the inname parameter, as used by the Name field...
