CVSS: 6.8EPSS: 1%CPEs: 7EXPL: 0CVE-2010-1454
https://notcve.org/view.php?id=CVE-2010-1454
com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password. Vulnerabilidad en el componente com.springsource.tcserver.serviceability.rmi.JmxSocketListener de VMware SpringSource tc Server Runtime v6.0.19, v6.0.20 anteriores a v6.0.20.D y v6.0.25.A anteriores a v6.0.25.A-SR01, no hace cumplir correctamente el requisito de contraseña cifrada (también conocido como s2enc), que permite a atacantes remotos obtener acceso al interfaz JMX a través de una contraseña vacía. • http://secunia.com/advisories/39778 http://www.securityfocus.com/archive/1/511307/100/0/threaded http://www.securityfocus.com/bid/40205 http://www.springsource.com/security/cve-2010-1454 https://exchange.xforce.ibmcloud.com/vulnerabilities/58684 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 2CVE-2009-2907 – SpringSource (Multiple Products) - Multiple HTML Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2009-2907
Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified "input fields." Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en SpringSource tc Server v6.0.20.B y anteriores, Application Management Suite (AMS) anterior a v2.0.0.SR4, Hyperic HQ Open Source anterior a v4.2.x, Hyperic HQ v4.0 Enterprise anterior a v4.0.3.2, e Hyperic HQ v4.1 Enterprise anterior a v4.1.2.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del campo "description" y en campos de entrada no especificados. SpringSource Hyperic HQ suffers from multiple stored cross site scripting vulnerability. • https://www.exploit-db.com/exploits/33794 http://www.securityfocus.com/bid/38913 http://www.springsource.com/security/cve-2009-2907 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 18EXPL: 2CVE-2009-2898 – Hyperic HQ 3.2 < 4.2-beta1 - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2009-2898
Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information. Vulnerabilidad de Ejecución de secuencias de comandos en sitios cruzados(XSS) en el listado de características Alerts en la interface web en SpringSource Hyperic HQ v3.2.x anteirior v3.2.6.1, v4.0.x anterior v4.0.3.1, v4.1.x anterior v4.1.2.1, y v4.2-beta1; Application Management Suite (AMS) v2.0.0.SR3; y tc Server v6.0.20.B permite a usuarios autentificados remotamente inyectar código web o HTML de su elección a través del campo Description. NOTA: algunos de estos detalles son obtenidos de información de terceros. • https://www.exploit-db.com/exploits/10013 http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=advisory&name=Hyperic_HQ_Multiple_XSS http://jira.hyperic.com/browse/HHQ-3390 http://secunia.com/advisories/36935 http://www.coresecurity.com/content/hyperic-hq-vulnerabilities http://www.osvdb.org/58611 http://www.securityfocus.com/archive/1/506935/100/0/threaded http://www.securityfocus.com/archive/1/506950/100/0/threaded http://www.springsource.com/security/hyperic-h • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 3CVE-2009-2897
https://notcve.org/view.php?id=CVE-2009-2897
Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de secuencias de comandos en hq/web/common/GenericError.jsp en el manejador de excepciones en la interface web en SpringSource Hyperic HQ v3.2.x anterior v3.2.6.1, v4.0.x anterior v4.0.3.1, v4.1.x anterior v4.1.2.1, y v4.2-beta1; Application Management Suite (AMS) v2.0.0.SR3; y tc Server v6.0.20.B permite a atacantes remotos ejecutar código web o HTML a su elección a través de valores no validos para los parámetros numéricos, como quedó demostrado en la excepción no capturada java.lang.NumberFormatException resultado del (1) parámetro typeId en mastheadAttach.do, (2) el parámetro eid en Resource.do, y(3) el parámetro u en una acción view en admin/user/UserAdmin.do. • http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=advisory&name=Hyperic_HQ_Multiple_XSS http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156嚌 http://jira.hyperic.com/browse/HHQ-2655 http://secunia.com/advisories/36935 http://www.coresecurity.com/content/hyperic-hq-vulnerabilities http://www.osvdb.org/58608 http://www.osvdb.org/58609 http://www.osvdb.org/58610 http://www.securityfocus.com/archive/1/506935/100/0/threaded http://www.security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •