PT-2014-6350

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager NAM versions 4.0.0 through 4.0.1 before HF3 Description The issue allows remote authenticated users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity...

PT-2014-6353

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager NAM versions 4.0 through 4.1 Description A cross-site request forgery CSRF issue exists in the Administration Console server, specifically in the nps/servlet/webacc component. This allows remote attackers to hijack the...

CVE-2014-5217: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...

CVE-2014-8890

IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations...

Design/Logic Flaw

IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations...

CVE-2014-8890

CVE-2014-8890 affects IBM WebSphere Application Server Liberty Profile (8.5.x) where a remote attacker can gain elevated privileges when deployment-descriptor security constraints are combined with ServletSecurity annotations. Root cause: improper handling of security configuration in the servlet...

PT-2014-8747

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server Liberty Profile versions 8.5.x through 8.5.5.3 Description The issue allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and...

CVE-2014-9372

Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro PMP before 7103 allows remote attackers to delete arbitrary files via a .. dot dot in a filename...

CVE-2014-9372: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro PMP before 7103 allows remote attackers to delete arbitrary files via a .. dot dot in a filename...

ManageEngine Password Manager Pro UploadAccountActivities filename Directory Traversal Denial of Service Vulnerability

This vulnerability allows remote attackers to create a denial of service condition on vulnerable installations of ManageEngine Password Manager Pro. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UploadAccountActivities servlet. The issue lies in...

CVE-2014-9301

Server-side request forgery SSRF vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter...

CVE-2014-9301

CVE-2014-9301 affects Alfresco Community Edition before 5.0.a, via a SSRF in the proxy servlet. A crafted endpoint parameter can trigger outbound requests to intranet servers, enabling port scans and reading arbitrary files. Public data reports CVSSv2 base score 6.4 (MEDIUM). Exploitation referen...

CVE-2014-9302

CVE-2014-9302 describes a server-side request forgery (SSRF) in the cmisbrowser servlet of CMIS in Alfresco Community Edition 5.0.a and earlier. The vulnerability allows remote attackers to trigger outbound requests by providing a crafted value in the url parameter. Affected component: cmisbrowse...

CVE-2014-9301: Undefined Security Weakness

Server-side request forgery SSRF vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter...

CVE-2014-9300: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the cmisbrowser servlet in Content Management Interoperability Service CMIS in Alfresco Community Edition before 5.0.a allows remote attackers to hijack the authentication of users for requests that access unauthorized URLs and obtain user...

CVE-2014-9302: Undefined Security Weakness

Server-side request forgery SSRF vulnerability in the cmisbrowser servlet in Content Management Interoperability Service CMIS in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in the url parameter...

[SECURITY] Fedora 21 Update: jenkins-winstone-2.8-1.fc21

Winstone is a servlet container that was written out of a desire to provide servlet functionality without the bloat that full J2EE compliance introduces...

Sql injection

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 OPMBVNAME parameter in a Delete operation to the APMBVHandler servlet ...

Path traversal

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...