Security Bulletin: Vulnerability in Apache Tomcat affects App Connect Professional.

Summary App Connect Professional have addressed the following vulnerabilities reported in Apache Tomcat. Vulnerability Details CVEID:CVE-2023-28708 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by the missing of secure attribute in some...

K000133402: Apache Tomcat vulnerability CVE-2023-28708

Security Advisory Description When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 di...

CVE-2022-36982: Improper Limitation of a Pathname to a Restricted Directory

This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandle...

CVE-2022-36982

This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandle...

Information Disclosure

org.apache.tomcat:tomcat-catalina is vulnerable to Information Disclosure. The vulnerability is due to the setSecure function in RemoteIpFilter.java because http requests with the X-Forwarded-Proto header set to https do not include the secure attribute, which could result in an session cookie...

Apache Tomcat Information Disclosure Vulnerability (Mar 2023) - Linux

Apache Tomcat is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...

CVE-2023-28117

Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitiv...

Apache Tomcat 10.1.0.M1 < 10.1.6

The version of Tomcat installed on the remote host is prior to 10.1.6. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.6security-10 advisory. - When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the...

CVE-2023-28708: Unprotected Transport of Credentials

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure...

CVE-2023-28117: Insertion of Sensitive Information Into Sent Data

Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitiv...

quarkus-vertx-http: a cross-site attack may be initiated which might lead to the Information Disclosure

A flaw was found in Quarkus. If the Quarkus Form Authentication session cookie Path attribute is set to /, then a cross-site attack may be initiated, which might lead to information disclosure...

Cross-site Scripting (XSS)

quarkus-vertx-http is vulnerable to Cross-site Scripting XSS. The vulnerability exists because the library's form authentication session cookie path attribute is set to /, which allows an attacker to redirect malicious URLs, resulting in information disclosure...

Design/Logic Flaw

If the Quarkus Form Authentication session cookie Path attribute is set to / then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature...

PT-2023-16572 · Opennms · Opennms Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4 Description: Reflected cross-site scripting in graph results could allow an attacker to steal session cookies. The software is intended for installation with...

CVE-2023-0044

If the Quarkus Form Authentication session cookie Path attribute is set to / then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature...

CVE-2023-0044

CVE-2023-0044 concerns Quarkus Form Authentication: if the session cookie Path is set to “/”, a cross-site attack may disclose information. The issue is described across multiple sources tied to Quarkus advisories (Red Hat RHSA entries and IBM/OSV records) and is mitigated by the Quarkus CSRF Pre...

CVE-2023-0044

If the Quarkus Form Authentication session cookie Path attribute is set to "/" then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature...

Apache Tomcat 11.0.0.M1 < 11.0.0.M3 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.0.M3. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.0-m3security-11 advisory. - When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include...

CVE-2021-43074

An improper verification of cryptographic signature vulnerability CWE-347 in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and...

SUSE CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...