Page 22 of 205 results (0.016 seconds)

CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0

CVE-2008-2945

https://notcve.org/view.php?id=CVE-2008-2945

Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715, CVE-2007-3716, and CVE-2007-4289. Sun Java System Access Manager 6.3 hasta 7.1 y Sun Java System Identity Server 6.1 y 6.2 no procesa adecuadamente hojas de estilo XSLT en transformaciones XSLT de firmas XML. • http://secunia.com/advisories/30893 http://sunsolve.sun.com/search/document.do?assetkey=1-26-201538-1 http://support.avaya.com/elmodocs2/security/ASA-2008-294.htm http://www.securityfocus.com/bid/29988 http://www.securitytracker.com/id?1020380 http://www.vupen.com/english/advisories/2008/1967/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43429 • CWE-20: Improper Input Validation •

CVSS: 7.1EPSS: 1%CPEs: 5EXPL: 0

CVE-2008-2749

https://notcve.org/view.php?id=CVE-2008-2749

Unspecified vulnerability in cshttpd in Sun Java System Calendar Server 6 and 6.3, and Sun ONE Calendar Server 6.0, when access logging (aka service.http.commandlog.all) is enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. Vulnerabilidad sin expecificar en cshttpd in Sun Java System Calendar Server 6 y 6.3, y Sun ONE Calendar Server 6.0, cuando el access logging (tambien conocido como service.http.commandlog.all) está activado, permite a atacantes remotos provocar una denegación de servicio (caida de demonio), a través de vectores no especificados. • http://secunia.com/advisories/30694 http://sunsolve.sun.com/search/document.do?assetkey=1-66-235521-1 http://www.securityfocus.com/bid/29763 http://www.securitytracker.com/id?1020299 http://www.vupen.com/english/advisories/2008/1857 https://exchange.xforce.ibmcloud.com/vulnerabilities/43127 •

CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 7

CVE-2008-2751 – GlassFish Application Server - '/Applications/lifecycleModulesNew.jsf' Multiple Cross-Site Scripting Vulnerabilities

https://notcve.org/view.php?id=CVE-2008-2751

Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, or (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (a) resourceNode/customResourceNew.jsf; the (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, or (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (b) resourceNode/externalResourceNew.jsf; the (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, or (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (c) resourceNode/jmsDestinationNew.jsf; the (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi or (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd parameter to (d) resourceNode/jmsConnectionNew.jsf; the (15) propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext or (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (e) resourceNode/jdbcResourceNew.jsf; the (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, or (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder parameter to (f) applications/lifecycleModulesNew.jsf; or the (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, or (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db parameter to (g) resourceNode/jdbcConnectionPoolNew1.jsf. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en la interfaz webadmin de Glassfish en Java System Application Server de Sun versión 9.1_01, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, o (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc en (a) el archivo resourceNode/customResourceNew.jsf; el parámetro (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, o (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc en (b) el archivo resourceNode/externalResourceNew.jsf; el parámetro (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, o (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc en (c) el archivo resourceNode/jmsDestinationNew.jsf; el parámetro (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi o (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd en (d) el archivo resourceNode/jmsConnectionNew.jsf; el parámetro (15) propertyForm:propertySheet:propertSectionTextField :jndiProp:jnditext o (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc en (e) el archivo resourceNode/jdbcResourceNew.jsf; el parámetro (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, o (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder en (f) el archivo aplicaciones/lifecycleModulesNew.jsf; o el parámetro (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, o (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db en (g) el archivo resourceNode/jdbcConnectionPoolNew1.jsf. • https://www.exploit-db.com/exploits/31927 https://www.exploit-db.com/exploits/31922 https://www.exploit-db.com/exploits/31923 https://www.exploit-db.com/exploits/31928 https://www.exploit-db.com/exploits/31926 https://www.exploit-db.com/exploits/31925 https://www.exploit-db.com/exploits/31924 http://securityreason.com/securityalert/3949 http://www.securityfocus.com/archive/1/493370/100/0/threaded http://www.securityfocus.com/bid/29751 https://exchange.xforce.ibmcloud • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.3EPSS: 1%CPEs: 1EXPL: 0

CVE-2008-2705

https://notcve.org/view.php?id=CVE-2008-2705

Unspecified vulnerability in Sun Java System Access Manager (AM) 7.1, when used with certain versions and configurations of Sun Directory Server Enterprise Edition (DSEE), allows remote attackers to bypass authentication via unspecified vectors. Vulnerabilidad no especificada en Sun Java System Access Manager (AM) 7.1, cuando se utiliza con determinadas versiones y configuraciones del Sun Directory Server Enterprise Edition (DSEE), permite a atacantes remotos evitar la autenticación a través de vectores no especificados. • http://secunia.com/advisories/30652 http://sunsolve.sun.com/search/document.do?assetkey=1-26-238416-1 http://www.securityfocus.com/bid/29676 http://www.securitytracker.com/id?1020273 http://www.vupen.com/english/advisories/2008/1806 https://exchange.xforce.ibmcloud.com/vulnerabilities/43004 • CWE-287: Improper Authentication •

CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0

CVE-2008-2403

https://notcve.org/view.php?id=CVE-2008-2403

Multiple directory traversal vulnerabilities in unspecified ASP applications in Sun Java Active Server Pages (ASP) Server before 4.0.3 allow remote attackers to read or delete arbitrary files via a .. (dot dot) in the Path parameter to the MapPath method. Múltiples vulnerabilidades de salto de directorio en Sun Java Active Server Pages (ASP) Server anterior a 4.0.3, permite a atacantes remotos leer o escribir ficheros de su elección a través de .. (punto punto) en el parámetro Path hacia el método MapPath. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=707 http://secunia.com/advisories/30523 http://sunsolve.sun.com/search/document.do?assetkey=1-66-238184-1 http://www.securityfocus.com/bid/29538 http://www.securitytracker.com/id?1020188 http://www.vupen.com/english/advisories/2008/1742/references https://exchange.xforce.ibmcloud.com/vulnerabilities/42831 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •