IBM Rational Focal Point Login Servlet Information Disclosure (CVE-2013-5397)

An information disclosure vulnerability has been reported in IBM Rational Focal Point. The vulnerability is due to an input validation error of the file variable in com.telelogic.focalpoint.pres.controller.LoginController servlet. A remote, unauthenticated attacker could exploit this vulnerabilit...

Fixed in Apache Tomcat 7.0.52

Note: The issue below was fixed in Apache Tomcat 7.0.51 but the release vote for the 7.0.51 release candidate did not pass. Therefore, although users must download 7.0.52 to obtain a version that includes a fix for this issue, version 7.0.51 is not included in the list of affected versions...

PT-2014-2921

Name of the Vulnerable Software and Affected Versions IBM Platform Symphony Developer Edition versions 5.2 through 6.1.1 Description The issue concerns hardcoded credentials in an unspecified servlet, allowing remote attackers to bypass authentication and gain access to the local environment...

Apache Commons FileUpload and Apache Tomcat - Denial of Service

Apache Commons FileUpload and Apache Tomcat - Denial of Service CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service Author: Oren Hafif, Trustwave SpiderLabs Research This is a Proof of Concept code that was created for the sole purpose of assisting system administrators in...

CVE-2013-1880

Cross-site scripting XSS vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092...

CVE-2013-1880

Cross-site scripting XSS vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092...

CVE-2013-1880

Cross-site scripting XSS vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092...

PT-2014-2512

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.9.0 Description A cross-site scripting XSS issue exists in the Portfolio publisher servlet within the demo web application. This allows remote attackers to inject arbitrary web script or HTML via the refresh...

CVE-2013-1880: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092...

HP Intelligent Management Center SOM Module Information Disclosure

The HP Intelligent Management Center IMC application running on the remote host is affected by an information disclosure vulnerability in the included IMC Service Operation Management SOM Module, specifically within the FileDownload servlet, due to a failure to require authentication. An...

IBM Rational Focal Point LoginController Servlet Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Rational Focal Point. Authentication is not required to exploit this vulnerability. The specific flaw exists within com.telelogic.focalpoint.pres.controller.LoginController servlet which contai...

CVE-2013-6810

The server in Brocade Network Advisor before 12.1.0, as used in EMC Connectrix Manager Converged Network Edition CMCNE, HP B-series SAN Network Advisor, and possibly other products, allows remote attackers to execute arbitrary code by using a servlet to upload an executable file...

PT-2013-6122

Name of the Vulnerable Software and Affected Versions Brocade Network Advisor versions prior to 12.1.0 Description The issue allows remote attackers to execute arbitrary code by using a servlet to upload an executable file. This is related to the FileUploadController Servlet in EMC Connectrix...

CVE-2013-6810: Improper Control of Generation of Code

The server in Brocade Network Advisor before 12.1.0, as used in EMC Connectrix Manager Converged Network Edition CMCNE, HP B-series SAN Network Advisor, and possibly other products, allows remote attackers to execute arbitrary code by using a servlet to upload an executable file...

Java based Cross platform malware targeting Apache Tomcat servers in the wild

Takashi Katsuki, a researcher at Antivirus firm Symantec has discovered a new cyber attack ongoing in the wild, targeting an open-source Web server application server Apache Tomcat with a cross platform Java based backdoor that can be used to attack other machines. The malware, dubbed as...

CVE-2013-3030

The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote attackers to cause a denial of service temporary gateway outage via crafted HTTP requests...

Code injection

The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote attackers to cause a denial of service temporary gateway outage via crafted HTTP requests...

CVE-2013-3030

The CVE-2013-3030 entry affects IBM Cognos Business Intelligence (BI) and Cognos Analytics platforms. Affected is the servlet gateway in IBM Cognos BI 10.2.1 and earlier (including 8.4.1 before IF3, 10.1.x before various IFs, and 10.2.1.x before IF1/IF2/IF4 as listed). The vulnerability allows re...

CVE-2013-3030: Improper Input Validation

The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote attackers to cause a denial of service temporary gateway outage via crafted HTTP requests...

Apache Tomcat 5.5.25 - Cross-Site Request Forgery

+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti http://ivanobinetti.com Author : Gianmarco Pirozzi...