CVSS: 7.3EPSS: 0%CPEs: 5EXPL: 0CVE-2019-11288 – tcServer JMX Socket Listener Registry Rebinding Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2019-11288
27 Jan 2020 — In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prior to 8.5.47.A, and 9.x versions prior to 9.0.27.A, when a tc Runtime instance is configured with the JMX Socket Listener, a local attacker without access to the tc Runtime process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The... • https://pivotal.io/security/cve-2019-11288 • CWE-269: Improper Privilege Management •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2011-0527
https://notcve.org/view.php?id=CVE-2011-0527
15 Aug 2011 — VMware vFabric tc Server (aka SpringSource tc Server) 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored passwords. VMware vFabric tc Server (también conocido como SpringSource tc Server) v2.0.x anterior a v2.0.6.RELEASE y v2.1.x anterior a v2.1.2.RELEASE acepta passwords ofuscados durante la autenticación JMX, lo que hace más fácil par... • http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0122.html • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2010-1454
https://notcve.org/view.php?id=CVE-2010-1454
19 May 2010 — com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password. Vulnerabilidad en el componente com.springsource.tcserver.serviceability.rmi.JmxSocketListener de VMware SpringSource tc Server Runtime v6.0.19, v6.0.20 anteriores a v6.0.20.... • http://secunia.com/advisories/39778 • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 2CVE-2009-2907 – SpringSource (Multiple Products) - Multiple HTML Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2009-2907
24 Mar 2010 — Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified "input fields." Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en SpringSource tc Server v6.0... • https://www.exploit-db.com/exploits/33794 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 3CVE-2009-2897
https://notcve.org/view.php?id=CVE-2009-2897
13 Oct 2009 — Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from ... • http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=advisory&name=Hyperic_HQ_Multiple_XSS • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 1%CPEs: 18EXPL: 2CVE-2009-2898 – Hyperic HQ 3.2 < 4.2-beta1 - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2009-2898
13 Oct 2009 — Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information. Vulnerabilidad de Ejecución de secuencias de comandos en sitios cruzados(XS... • https://www.exploit-db.com/exploits/10013 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •