apache tomcat vulnerabilities and exploits

(subscribe to this query)

5.1

CVSSv2

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the...

Apache Tomcat Canonical Ubuntu Linux Debian Debian Linux Opensuse Leap

4.3

CVSSv2

JBossWeb Bayeux has reflected XSS...

Redhat Jboss Enterprise Application Platform Jboss Portal

NA

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none....

7.5

CVSSv2

The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on...

Ruby-lang Ruby

5

CVSSv2

PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output....

Php Debian Debian Linux Redhat Enterprise Linux

2.6

CVSSv2

Cache Poisoning issue exists in DNS Response Rate Limiting....

Isc Bind Nic Knot Resolver Nlnetlabs Nsd Redhat Enterprise Linux

4.3

CVSSv2

While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distributions who made...

Isc Bind

5

CVSSv2

The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other...

Debian Debian Linux

5

CVSSv2

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on...

Cisco Data Center Network Manager1 EDB exploit available1 Metasploit module available2 Articles available

7.5

CVSSv2

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due...

Cisco Data Center Network Manager1 EDB exploit available2 Metasploit modules available3 Articles available

« PREV 1 2 3 4 5 6 7 8 NEXT »