CVE-2016-0714

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

UBUNTU-CVE-2016-0714

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

Apache Tomcat Security Manager Remote Code Execution Vulnerability

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat Security Manager suffers from a security restriction bypass vulnerability in the implementation of the session persistence mechanism that allows an attacker to place constructed objects in a session, which can be...

Fixed in Apache Tomcat 6.0.45

Low: Limited directory traversal CVE-2015-5174 This issue only affects users running untrusted web applications under a security manager. When accessing resources via the ServletContext methods getResource getResourceAsStream and getResourcePaths the paths should be limited to the current web...

Seditio CMS 1.7.1 Password Disclosure

Exploit Title: Seditio CMS Multiple Vulnerabilities + Google Dork: intext:"Powered by Seditio CMS" + Date: 27/7/2015 + Exploit Author: Arash Khazaei + Vendor Homepage: http://www.seditiocms.com/ + Software Link: http://www.seditiocms.com/page.php?id=20&a=dl + Version: 1.7.1Last Version + Tested...

IBM WebSphere Service Registry and Repository 8.5 < 8.5.0.1 Multiple Vulnerabilities

The version of IBM WebSphere Service Registry and Repository WSRR is version 8.5 prior to 8.5.0.1. It is therefore, affected by multiple vulnerabilities : - An unspecified DOM based cross-site scripting XSS vulnerability in the WSRR web UI. CVE-2014-6132 - WSSR web interface issues a cookie that ...

CVE-2003-1095

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate...

CVE-2003-1095

BEA WebLogic Server/Express 7.0 and 7.0.0.1 are affected by CVE-2003-1095 due to improper handling of memory session persistence: authentication data is not cleared on redeploy, potentially allowing re-authenticated access without re-signing in. The issue is described across multiple feeds (NVD/N...

CVE-2003-1095

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate...