CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2007-4025
https://notcve.org/view.php?id=CVE-2007-4025
Unspecified vulnerability in Sun Java System (SJS) Application Server 8.1 through 9.0 before 20070724 on Windows allows remote attackers to obtain JSP source code via unspecified vectors. Vulnerabilidad sin especificar en el Sun Java System (SJS) Application Server 8.1 hasta la 9.0 anterior al 20070724 bajo Windows, permite a atacantes remotos la obtención de código fuente JSP a través de vectores sin especificar. • http://osvdb.org/37250 http://secunia.com/advisories/26187 http://sunsolve.sun.com/search/document.do?assetkey=1-26-103000-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-201537-1 http://www.securityfocus.com/bid/25058 http://www.securitytracker.com/id?1018452 http://www.vupen.com/english/advisories/2007/2647 https://exchange.xforce.ibmcloud.com/vulnerabilities/35579 •
CVSS: 9.3EPSS: 2%CPEs: 21EXPL: 0CVE-2007-3715
https://notcve.org/view.php?id=CVE-2007-3715
Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716. Sun Java System Application Server y Web Server versiones 7.0 hasta 9.0 anterior al 20070710, no procesan apropiadamente las hojas de estilo XSLT en las transformaciones de XSLT en firmas XML, lo que permite a atacantes dependiendo del contexto ejecutar un método Java arbitrario por medio de una hoja de estilo diseñada, un problema relacionado con CVE-2007-3716. • http://osvdb.org/37248 http://secunia.com/advisories/26023 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102992-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200054-1 http://www.isecpartners.com/advisories/2007-04-dsig.txt http://www.isecpartners.com/files/XMLDSIG_Command_Injection.pdf http://www.securityfocus.com/archive/1/473552/100/0/threaded http://www.securityfocus.com/archive/1/473553/100/0/threaded http://www.securityfocus.com/bid/24850 http& • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 8EXPL: 0CVE-2006-6276
https://notcve.org/view.php?id=CVE-2006-6276
HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors. Vulnerabilidad de contrabando de petición HTTP en Sun Java System Proxy Server anterior al 30/11/2006, cuando se usa con Sun Java System Application Server o Sun Java System Web Server, permite a atacantes remotos evitar el filtrado de petición HTTP, secuestrar sesiones web, realizar ataques de secuencias de comandos en sitios cruzados (XSS), y falsear la caché web mediante vectores de ataque no especificados. • http://secunia.com/advisories/23186 http://securitytracker.com/id?1017322 http://securitytracker.com/id?1017323 http://securitytracker.com/id?1017324 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1 http://www.securityfocus.com/bid/21371 http://www.vupen.com/english/advisories/2006/4793 https://exchange.xforce.ibmcloud.com/vulnerabilities/30662 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 0CVE-2006-5654
https://notcve.org/view.php?id=CVE-2006-5654
Unspecified vulnerability in the Network Security Services (NSS) in Sun Java System Web Server 6.0 before SP 10 and ONE Application Server 7 before Update 3, when SSLv2 is enabled, allows remote authenticated users to cause a denial of service (application crash) via unspecified vectors. NOTE: due to lack of details from the vendor, it is unclear whether this is related to vector 1 in CVE-2006-5201 or CVE-2006-3127. Vulnerabilidad no especificada en Network Security Services (NSS) de Sun Java System Web Server 6.0 versiones anteriores a SP 10 y ONE Application Server 7 anteriores a Update 3, cuando SSLv2 está habilitado, permite a usuarios remotos autenticados provocar una denegación de servicio (fallo de aplicación) mediante vectores no especificados. NOTA: debido a la falta de detalles por parte del fabricanet, no está claro si esto está relacionado con el vector 1 en CVE-2006-5201. • http://secunia.com/advisories/22646 http://securitytracker.com/id?1017143 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102670-1 http://www.securityfocus.com/bid/20846 http://www.vupen.com/english/advisories/2006/4299 https://exchange.xforce.ibmcloud.com/vulnerabilities/29946 •
CVSS: 4.0EPSS: 0%CPEs: 25EXPL: 0CVE-2006-3921
https://notcve.org/view.php?id=CVE-2006-3921
Sun Java System Application Server (SJSAS) 7 through 8.1 and Web Server (SJSWS) 6.0 and 6.1 allows remote authenticated users to read files outside of the "document root directory" via a direct request using a UTF-8 encoded URI. Sun Java System Application Server (SJSAS) 7 hasta la 8.1 y Web Server (SJSWS) 6.0 y 6.1 permite a usuarios remotos validados leer archivos fuera del "directorio de documentos del root" a través de respuesta directas utilizando una codificación URI UTF-8. • http://secunia.com/advisories/21251 http://secunia.com/advisories/22425 http://securitytracker.com/id?1016596 http://securitytracker.com/id?1016597 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102521-1 http://support.avaya.com/elmodocs2/security/ASA-2006-204.htm http://www.securityfocus.com/bid/19200 http://www.vupen.com/english/advisories/2006/3020 https://exchange.xforce.ibmcloud.com/vulnerabilities/28061 •