Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
ApacheGeronimo

10 matches found

CVE
CVE•added 2011/12/30 1:55 a.m.•105 views

CVE-2011-5034

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

7.8CVSS5.3AI score0.66459EPSS
CVE
CVE•added 2006/01/18 2:0 a.m.•96 views

CVE-2006-0254

Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.

4.3CVSS7.9AI score0.45321EPSS
CVE
CVE•added 2009/04/17 2:30 p.m.•74 views

CVE-2009-0039

Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applica...

6.8CVSS7.9AI score0.04509EPSS
CVE
CVE•added 2013/07/11 10:55 p.m.•64 views

CVE-2013-1777

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to ...

10CVSS7.5AI score0.04819EPSS
CVE
CVE•added 2009/04/17 2:30 p.m.•62 views

CVE-2008-5518

Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fil...

9.4CVSS7.6AI score0.15783EPSS
CVE
CVE•added 2009/04/17 2:30 p.m.•48 views

CVE-2009-0038

Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/M...

4.3CVSS6.7AI score0.16672EPSS
CVE
CVE•added 2008/02/12 9:0 p.m.•45 views

CVE-2008-0732

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.

2.1CVSS6.3AI score0.00054EPSS
CVE
CVE•added 2007/08/27 11:17 p.m.•41 views

CVE-2007-4548

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with t...

10CVSS7.5AI score0.00746EPSS
CVE
CVE•added 2007/09/26 10:17 a.m.•41 views

CVE-2007-5085

Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors.

5CVSS6.9AI score0.00655EPSS
CVE
CVE•added 2007/11/03 12:46 a.m.•31 views

CVE-2007-5797

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.

7.5CVSS6.8AI score0.00709EPSS