CVE-2010-0557
published 2010-02-05CVE-2010-0557: IBM Cognos Express 9.0 allows attackers to obtain unspecified access to the Tomcat Manager component, and cause a denial of service, by leveraging hardcoded…
PriorityP357high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
51.07%
98.8th percentile
IBM Cognos Express 9.0 allows attackers to obtain unspecified access to the Tomcat Manager component, and cause a denial of service, by leveraging hardcoded credentials.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | cognos_express | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Apache Tomcat Manager - Application Deployer (Authenticated) Code Execution (Metasploit)
exploitdb·2010-12-14
CVE-2010-4094 Apache Tomcat Manager - Application Deployer (Authenticated) Code Execution (Metasploit)
Apache Tomcat Manager - Application Deployer (Authenticated) Code Execution (Metasploit)
---
##
# $Id: tomcat_mgr_deploy.rb 11330 2010-12-14 17:26:44Z egypt $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 [ /Apache.*(Coyote|Tomcat)/ ] }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
def initialize(info = {})
super(update_info(info,
'Name' => 'Apache Tomcat Manager Application Deployer Authenticated Code Execution',
'Description' => %q{
This module can be used to execute a payload on Apache Tomcat servers that
have an
Metasploit
Apache Tomcat Manager Application Deployer Authenticated Code Execution
metasploit
Apache Tomcat Manager Application Deployer Authenticated Code Execution
Apache Tomcat Manager Application Deployer Authenticated Code Execution
This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a PUT request. The manager application can also be abused using /manager/html/upload, but that method is not implemented in this module. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads.
Metasploit
Apache Tomcat Manager Authenticated Upload Code Execution
metasploit
Apache Tomcat Manager Authenticated Upload Code Execution
Apache Tomcat Manager Authenticated Upload Code Execution
This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads.
Metasploit
Tomcat Application Manager Login Utility
metasploit
Tomcat Application Manager Login Utility
Tomcat Application Manager Login Utility
This module simply attempts to login to a Tomcat Application Manager instance using a specific user/pass.
No writeups or analysis indexed.
http://secunia.com/advisories/38457http://www-01.ibm.com/support/docview.wss?uid=swg21419179http://www.osvdb.org/62118http://www.securityfocus.com/bid/38084http://www.vupen.com/english/advisories/2010/0297http://secunia.com/advisories/38457http://www-01.ibm.com/support/docview.wss?uid=swg21419179http://www.osvdb.org/62118http://www.securityfocus.com/bid/38084http://www.vupen.com/english/advisories/2010/0297
2010-02-05
Published