CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

CVE-2002-1148

CVE-2002-1148 refers to a vulnerability in Apache Tomcat where the default servlet (org.apache.catalina.servlets.DefaultServlet) on Tomcat 4.0.4, 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. Connected sources (GHSA and OSS/ID...

CVE-2002-1394: Undefined Security Weakness

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

CVE-2002-0682: Undefined Security Weakness

Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet...

CVE-2003-0104: Undefined Security Weakness

Directory traversal vulnerability in PeopleTools 8.10 through 8.18, 8.40, and 8.41 allows remote attackers to overwrite arbitrary files via the SchedulerTransfer servlet...

thttpd < 2.20 ssi Servlet Traversal File Access

Binary data 1468.prm...

Apache Tomcat Snoop Servlet Remote Information Disclosure

Binary data 1464.prm...

WebLogic Internal Management Servlet Authentication Bypass

Binary data 1455.prm...

Apache Tomcat < 3.3.1a Servlet Engine MS/DOS Device Name DoS

Binary data 1467.pasl...

Character not allowed in user name

A user has sign up with the user name "m&m". The i tried to modify this user. Because the username is passed as url parameter FooServlet?name=m&m : GET or POST method the servlet container cut the name and try to retreive the username named "m" !!! The only way is to use a database client, change...

Character not allowed in user name

A user has sign up with the user name "m&m". The i tried to modify this user. Because the username is passed as url parameter FooServlet?name=m&m : GET or POST method the servlet container cut the name and try to retreive the username named "m" !!! The only way is to use a database client, change...

Character not allowed in user name

A user has sign up with the user name "m&m". The i tried to modify this user. Because the username is passed as url parameter FooServlet?name=m&m : GET or POST method the servlet container cut the name and try to retreive the username named "m" !!! The only way is to use a database client, change...

Novell Groupwise Servlet Manager Default Password

The Novell Groupwise servlet server is configured with a default password. As a result, users could be denied access to mail and other servlet based resources. To test this finding: https:///servlet/ServletManager/ enter 'servlet' for the user and 'manager' for the password. This script was writt...

Resin Status Page Information Disclosure

Requesting the URI '/caucho-status' or '/server-status' gives information about the currently running Resin java servlet container. %NASLMINLEVEL 70300 This script was written by Vincent Renardias Licence : GPL v2 Changes by Tenable: - Revised plugin title, family change 4/2/2009...

CVE-2003-0628

This CVE affects the PeopleSoft Gateway Administration servlet (gateway.administration) in PeopleTools 8.43 and earlier. An attacker can disclose the full pathnames of server-side include (SSI) files by sending an HTTP request with an invalid value, a path-disclosure vulnerability impacting confi...

CVE-2003-0950

CVE-2003-0950 affects PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x. The issue allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the directory name (based on system time) used to store the file, and directly requesting that file. The underlyi...

CVE-2003-0950: Undefined Security Weakness

PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the insufficiently random system time name of the directory used to store the file, and directly requesting that file...

CVE-2003-0628: Undefined Security Weakness

PeopleSoft Gateway Administration servlet gateway.administration in PeopleTools 8.43 and earlier allows remote attackers to obtain the full pathnames for server-side include SSI files via an HTTP request with an invalid value...

ISS Security Brief: PeopleSoft IClient Servlet Remote Command Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Brief November 12, 2003 PeopleSoft IClient Servlet Remote Command Execution Vulnerability Synopsis: ISS X-Force has discovered a flaw in a servlet that is part of the PeopleSoft PeopleTools application framework. PeopleSoft...

security flaw

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...