Moderate: Red Hat Security Advisory: tomcat6 security update

Updated tomcat6 packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Design/Logic Flaw

Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a guiinputtest.pl params parameter to servlet/Installer...

CVE-2014-0359

Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a guiinputtest.pl params parameter to servlet/Installer...

PT-2014-3588

Name of the Vulnerable Software and Affected Versions Xangati XSR versions prior to 11 Xangati XNR versions prior to 7 Description The issue allows remote attackers to execute arbitrary commands. This is achieved by using shell metacharacters in a gui input test.pl params parameter to the...

PT-2014-3587

Name of the Vulnerable Software and Affected Versions Xangati XSR versions prior to 11 Xangati XNR versions prior to 7 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in various parameters. This can be achieved through several API endpoints, including:...

CVE-2014-0359: Improper Neutralization of Special Elements used in an OS Command

Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a guiinputtest.pl params parameter to servlet/Installer...

Xangati - servletMGConfigData Multiple Directory Traversals

Xangati - servletMGConfigData Multiple Directory Traversals source: https://www.securityfocus.com/bid/66817/info Xangati XSR And XNR are prone to a multiple directory-traversal vulnerabilities. A remote attacker could exploit these vulnerabilities using directory-traversal characters '../' to...

Debian Security Advisory DSA 2897-1 (tomcat7 - security update)

Multiple security issues were found in the Tomcat servlet and JSP engine: CVE-2013-2067 FORM authentication associates the most recent request requiring authentication with the current session. By repeatedly sending a request for an authenticated resource while the victim is completing the login...

[SECURITY] Fedora 20 Update: xalan-j2-2.7.1-22.fc20

Xalan is an XSLT processor for transforming XML documents into HTML, text, or other XML document types. It implements the W3C Recommendations for XSL Transformations XSLT and the XML Path Language XPath. It can be used from the command line, in an applet or a servlet, or as a module in other...

[SECURITY] Fedora 19 Update: xalan-j2-2.7.1-22.fc19

Xalan is an XSLT processor for transforming XML documents into HTML, text, or other XML document types. It implements the W3C Recommendations for XSL Transformations XSLT and the XML Path Language XPath. It can be used from the command line, in an applet or a servlet, or as a module in other...

IBM Platform Symphony DE Auth-Bypass Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Platform Symphony DE. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

JBoss Status Servlet Information Gathering

This module queries the JBoss status servlet to collect sensitive information, including URL paths, GET parameters and client IP addresses. This module has been tested against JBoss 4.0, 4.2.2 and 4.2.3. This module requires Metasploit: https://metasploit.com/download Current source:...

PT-2014-1444

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 6.0.40 Apache Tomcat versions 7.x prior to 7.0.53 Apache Tomcat versions 8.x prior to 8.0.4 Description The issue exists due to improper restriction of XSLT stylesheets in the default servlet of Apache Tomcat,...

PT-2014-4797

Name of the Vulnerable Software and Affected Versions McAfee Asset Manager version 6.6 Description A directory traversal issue exists, allowing remote authenticated users to read arbitrary files. This is achieved by using a .. dot dot in the reportFileName parameter of the servlet/downloadReport...

CVE-2014-2588: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. dot dot in the reportFileName parameter...

CVE-2014-2276

The FileUploadController servlet in EMC Connectrix Manager Converged Network Edition CMCNE before 12.1.5 does not properly restrict additions to the Connectrix Manager repository, which allows remote attackers to obtain sensitive information by importing a crafted firmware file...

Symantec Endpoint Protection Manager XXE and SQL Injection Vulnerabilities

Symantec Endpoint Protection Manager is prone to XXE and SQL injection vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Oracle Reports Servlet Remote File Access

Nessus was able to exploit a file access vulnerability in the Oracle Reports servlet and retrieve to contents of a file. A remote attacker could use this vulnerability to read or write arbitrary files on the system, ultimately leading to remote code execution. %NASLMINLEVEL 70300 C Tenable Networ...

Oracle Reports Servlet Detection

Binary data oraclereportsdetect.nbin...

IBM Rational Focal Point RequestAccessController Servlet Information Disclosure (CVE-2013-5398)

An information disclosure vulnerability has been reported in IBM Focal Point. The vulnerability is due to input validation error of file variable in com.telelogic.focalpoint.pres.controller.RequestAccessController servlet. A remote unauthenticated attacker could exploit this vulnerability to read...