CVE-2012-4825: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in servlet/traveler/ILNT.mobileconfig in IBM Lotus Notes Traveler before 8.5.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 userId or 2 address parameter in a getClientConfigFile action...

CVE-2012-5308: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 allows remote attackers to hijack the authentication of arbitrary users for requests that create problem reports via a getReportProblem upload action...

PT-2012-5908

Name of the Vulnerable Software and Affected Versions IBM Lotus Notes Traveler versions prior to 8.5.3.3 Interim Fix 2 Description The issue is related to the servlet/traveler component in IBM Lotus Notes Traveler, which does not properly restrict invalid authentication attempts. This makes it...

CVE-2012-4824: Improper Input Validation

Open redirect vulnerability in servlet/traveler in IBM Lotus Notes Traveler 8.5.3 before 8.5.3.3 Interim Fix 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirectURL parameter...

SAP DevInfPage - Security Bypass

Application: SAP NetWeaver J2EE Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs: Security Bypass Exploits: YES Reported: 25.09.2012 Vendor response: 26.09.2013 Date of Public Advisory: 09.07.2013 Reference: SAP Security Note 1831053 Author: Dmitry Chastukhin ERPScan Descripti...

CVE-2012-2316

OpenKM 5.1.7 and earlier versions up to 5.1.8-2 are affected by a CSRF flaw in servlet/admin/AuthServlet.java. The issue allows remote attackers to hijack administrator sessions and cause arbitrary code execution via the script parameter to admin/scripting.jsp. Connected sources confirm the vulne...

[SECURITY] Fedora 17 Update: tomcat6-6.0.35-1.fc17

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

[SECURITY] Fedora 16 Update: tomcat6-6.0.35-1.fc16

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

reflected xss in the pageId request parameter in 500page.jsp

A scanner picked up that the pageId parameter in 500page.jsp is a potentially reflected xss bug. This can be exploited through a url like the following: https://example.com/pages/viewtrash.vm;editpage?pageId=%22%3E%3Cscript%3Ealert1%3C/script%3E code /images/icons/emoticons/warning.png" You can...

reflected xss in the pageId request parameter in 500page.jsp

A scanner picked up that the pageId parameter in 500page.jsp is a potentially reflected xss bug. This can be exploited through a url like the following: https://example.com/pages/viewtrash.vm;editpage?pageId=%22%3E%3Cscript%3Ealert1%3C/script%3E code /images/icons/emoticons/warning.png" You can...

Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web...

Scientific Linux Security Update : tomcat6 on SL6.x (20120411)

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was found that the Java hashCode method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time b...

Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64 (20120411)

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was found that the Java hashCode method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time b...

Scientific Linux Security Update : tomcat on SL5.x i386/x86_64

A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. CVE-2008-1232 An additional cross-site scripting vulnerability was discovered in the host manager application. A...

CentOS Update for tomcat5 CESA-2011:1845 centos5 x86_64

Check for the Version of tomcat5 OpenVAS Vulnerability Test CentOS Update for tomcat5 CESA-2011:1845 centos5 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CentOS Update for tomcat6 CESA-2011:1780 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2012-2138

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

Cross site request forgery (csrf)

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

CVE-2012-2138

The vulnerability CVE-2012-2138 affects the Apache Sling project, specifically the org.apache.sling.servlets.post bundle before version 2.1.2. The @CopyFrom operation in the Sling POST servlet fails to prevent copying an ancestor node to a descendant, enabling remote attackers to trigger a denial...

CVE-2012-2138

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...