exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 15 of 15 RSS Feed

CVE-2018-1304

Status Candidate

Overview

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Related Files

Red Hat Security Advisory 2019-2205-01
Posted Aug 6, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-2205-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies.

tags | advisory, java
systems | linux, redhat
advisories | CVE-2018-1304, CVE-2018-1305, CVE-2018-8014, CVE-2018-8034
SHA-256 | f96edb5fc14ab2e42f8e92f288425a6036cbaf041f5349ff45e21fa23565b6f1
1Password Denial Of Service
Posted Jan 16, 2019
Authored by Valerio Brussani

1Password versions prior to 7.0 suffer from a denial of service vulnerability.

tags | exploit, denial of service
advisories | CVE-2018-13042
SHA-256 | ef142489adece1b1e6f31f1812ddee20236f26a770e4f0a467699df795f8c7da
Yeswiki Cercopitheque SQL Injection
Posted Dec 19, 2018
Authored by Mickael Brouty

Yeswiki Cercopitheque suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
advisories | CVE-2018-13045
SHA-256 | 2191ee618f205f47d949b3798efa5fd260cfb4e592d66b79ca96cc83ced25bff
Red Hat Security Advisory 2018-2939-01
Posted Oct 18, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-2939-01 - Red Hat Fuse Integration Services provides a set of tools and containerized xPaaS images that enable development, deployment, and management of integration microservices within OpenShift. Security fix: jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries spring-framework: Address partial fix for CVE-2018-1270 Issues addressed include bypass, code execution, denial of service, and traversal vulnerabilities.

tags | advisory, denial of service, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2017-12617, CVE-2018-1260, CVE-2018-1270, CVE-2018-1271, CVE-2018-1275, CVE-2018-1304, CVE-2018-1305, CVE-2018-1336, CVE-2018-7489
SHA-256 | df886e50a83354eaf0614cdf4bb930a04577e8f124f9e750b2d4ca2e9e06e04e
Debian Security Advisory 4281-1
Posted Aug 29, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4281-1 - Several issues were discovered in the Tomcat servlet and JSP engine. They could lead to unauthorized access to protected resources, denial-of-service, or information leak.

tags | advisory
systems | linux, debian
advisories | CVE-2018-1304, CVE-2018-1305, CVE-2018-1336, CVE-2018-8034, CVE-2018-8037
SHA-256 | 604c5094b1c4bc66945081a57708d07c2e803518e043a3487002861f782bc32c
Ubuntu Security Notice USN-3704-1
Posted Jul 5, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3704-1 - It was discovered that devscripts incorrectly handled certain YAML files. An attacker could possibly use this to execute arbitrary code.

tags | advisory, arbitrary
systems | linux, ubuntu
advisories | CVE-2018-13043
SHA-256 | a16655925322ab5e126d0d9869ac6db0dfac77a986cb37a44b5f0fe6bcf64e0c
Ubuntu Security Notice USN-3665-1
Posted May 31, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3665-1 - It was discovered that Tomcat incorrectly handled being configured with HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP file to the server and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 17.10. It was discovered that Tomcat contained incorrect documentation regarding description of the search algorithm used by the CGI Servlet to identify which script to execute. This issue only affected Ubuntu 17.10. Various other issues were also addressed.

tags | advisory, remote, web, arbitrary, cgi
systems | linux, ubuntu
advisories | CVE-2017-12616, CVE-2017-12617, CVE-2017-15706, CVE-2018-1304, CVE-2018-1305, CVE-2018-8014
SHA-256 | adc3401f4c6099499fc7f32dd5cfa60804e4fe107e205fa1ebecec9060700bf5
Red Hat Security Advisory 2018-1448-01
Posted May 15, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-1448-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution and traversal vulnerabilities.

tags | advisory, java, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2016-4978, CVE-2017-15095, CVE-2017-17485, CVE-2017-3163, CVE-2018-1304, CVE-2018-7489, CVE-2018-8088
SHA-256 | 3c0c1ca65d59c2c4e54c42628e2675bc4b0c3a29236da3e884ab31d478a28679
Red Hat Security Advisory 2018-1449-01
Posted May 15, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-1449-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution and traversal vulnerabilities.

tags | advisory, java, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2016-4978, CVE-2017-15095, CVE-2017-17485, CVE-2017-3163, CVE-2017-7525, CVE-2018-1304, CVE-2018-7489, CVE-2018-8088
SHA-256 | f070e28e8e82699624cb25ee0c2660f74d5f3385a6584e52ebfcc2f6d8983c73
Red Hat Security Advisory 2018-1447-01
Posted May 15, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-1447-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution and traversal vulnerabilities.

tags | advisory, java, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2016-4978, CVE-2017-15095, CVE-2017-17485, CVE-2017-3163, CVE-2018-1304, CVE-2018-7489, CVE-2018-8088
SHA-256 | bafa2c4701c1956e519818e15b5819d0d12df2733c02541185a265d7a4fd8c69
Red Hat Security Advisory 2018-1451-01
Posted May 15, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-1451-01 - The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services Elastic Compute Cloud. With this update, the jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 6.4.19. Issues addressed include code execution and traversal vulnerabilities.

tags | advisory, web, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2016-4978, CVE-2017-15095, CVE-2017-17485, CVE-2017-3163, CVE-2018-1304, CVE-2018-7489, CVE-2018-8088
SHA-256 | 071f79f013467ccb6e777f227def5d0666e250099e79aecdeacde603e7f87b14
Red Hat Security Advisory 2018-1450-01
Posted May 15, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-1450-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution and traversal vulnerabilities.

tags | advisory, java, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2016-4978, CVE-2017-15095, CVE-2017-17485, CVE-2017-3163, CVE-2017-7525, CVE-2018-1304, CVE-2018-7489, CVE-2018-8088
SHA-256 | df4e2952c8fb6dd18bda14d8ee9ce25b96718185533685523d56a0e9fd70c167
Red Hat Security Advisory 2018-1320-01
Posted May 4, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-1320-01 - Red Hat Openshift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications for OpenShift as a containerized platform. This release of RHOAR Spring Boot 1.5.12 serves as a replacement for RHOAR Spring Boot 1.5.10, and includes bug fixes and enhancements. For further information, refer to the Release Notes linked to in the References section. Issues addressed include a traversal vulnerability.

tags | advisory
systems | linux, redhat
advisories | CVE-2018-1271, CVE-2018-1272, CVE-2018-1275, CVE-2018-1304, CVE-2018-1305
SHA-256 | dda23c55eb322f14c521610d328717d78eddc9f5c5d9cbcd1faa007d32bb490f
Red Hat Security Advisory 2018-0465-01
Posted Mar 7, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-0465-01 - Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector, JBoss HTTP Connector, Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.1 Service Pack 2 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Multiple security issues have been addressed.

tags | advisory, java, web
systems | linux, redhat
advisories | CVE-2017-12613, CVE-2017-12615, CVE-2017-12616, CVE-2017-12617, CVE-2017-15698, CVE-2018-1304, CVE-2018-1305
SHA-256 | fc2ac908d0bafcba8906caa1a1fcfa1bcf09381311da134d34b27b4e2a339c72
Red Hat Security Advisory 2018-0466-01
Posted Mar 7, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-0466-01 - Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector, JBoss HTTP Connector, Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.1 Service Pack 2 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Multiple security issues have been addressed.

tags | advisory, java, web
systems | linux, redhat
advisories | CVE-2017-12613, CVE-2017-12615, CVE-2017-12616, CVE-2017-12617, CVE-2017-15698, CVE-2018-1304, CVE-2018-1305
SHA-256 | 68179df4be23fc5ae853a6269f702f02d3b88b7dda20c7e7f949e30659effdff
Page 1 of 1
Back1Next

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close