Oracle Linux 7 : tomcat (ELSA-2016-2599)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2599 advisory. - Resolves: rhbz1350438 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service - Rebase Resolves: rhbz1293292...

CA Unified Infrastructure Management diag Path Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information from vulnerable installations of CA Unified Infrastructure Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of the diag.jsp servlet. The servlet is...

CA Unified Infrastructure Management download_lar Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information from vulnerable installations of CA Unified Infrastructure Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of the downloadlar servlet. The servlet is...

CA Unified Infrastructure Management get_sessions Session Information Disclosure Remote Authentication Bypass Vulnerability

This vulnerability allows remote attackers to disclose session information on vulnerable installations of CA Unified Infrastructure Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of the getsessions servlet. The servlet can retu...

Updated tomcat packages fix security vulnerability

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder...

Apache Tomcat 6.0.x < 6.0.47 / 7.0.x < 7.0.72 / 8.0.x < 8.0.37 Multiple Vulnerabilities

Binary data 9723.pasl...

Moderate: Red Hat Security Advisory: tomcat security, bug fix, and enhancement update

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

XXE Vulnerability in TRS Portal Personalization Portal

TRS Portal for TORS company developed a set of completely based on J2EE and browser technology, personalized portal general-purpose software. TRS Portal personalized portal ServiceControler Servlet can be accessed without logging in, and there is a XXE entity injection vulnerability. This...

dotCMS < 3.3.1 Multiple SQLi Vulnerabilities - Active Check

dotCMS is prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dotcms:dotcms"; i...

CVE-2016-6796

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

UBUNTU-CVE-2016-6796

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

IBM WebSphere Application Server 7.0 < 7.0.0.39 Multiple Vulnerabilities (FREAK)

Binary data 9700.prm...

CVE-2016-7065

The JMX servlet in Red Hat JBoss Enterprise Application Platform EAP 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object...

CVE-2016-7065

The JMX servlet in Red Hat JBoss Enterprise Application Platform EAP 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object...

CVE-2016-7065

The CVE-2016-7065 issue affects Red Hat JBoss EAP 4.x/5.x, where the JMX Invoker Servlet deserializes untrusted data. This can lead to a denial of service and, via crafted serialized Java objects, potentially remote code execution. Remote authenticated users are able to trigger the vulnerability;...

CVE-2016-7065

The JMX servlet in Red Hat JBoss Enterprise Application Platform EAP 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object...

CVE-2016-7065: Deserialization of Untrusted Data

The JMX servlet in Red Hat JBoss Enterprise Application Platform EAP 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object...

PT-2016-7197

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform EAP versions 4 and 5 Description The issue allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object. This is related t...

Red Hat Jboss Remote Code Execution Vulnerability

Red Hat JBoss Enterprise Application Platform EAP is the United States Red Hat Red Hat company's set of open source, J2EE-based middleware platform. The platform is mainly used to build, deploy and host Java applications and services. A remote code execution vulnerability exists in the JMX servle...

Important: Red Hat Security Advisory: tomcat6 security and bug fix update

An update for tomcat6 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...