SPI Labs

3 exploits Active since Jun 2003
CVE-2003-0413 EXPLOITDB text WORKING POC
Sun ONE Application Server 7.0 and Java System Web Server 6.1 - Cross-Site Scripting via Invalid JSP File Error
Cross-site scripting (XSS) vulnerability in the webapps-simple sample application for (1) Sun ONE Application Server 7.0 for Windows 2000/XP or (2) Sun Java System Web Server 6.1 allows remote attackers to insert arbitrary web script or HTML via an HTTP request that generates an "Invalid JSP file" error, which inserts the text in the resulting error message.
CVE-2003-0411 EXPLOITDB HIGH text WRITEUP
Sun ONE App Server 7.0 - Info Disclosure
Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase .jsp extension.
CVSS 7.5
CVE-2005-1112 EXPLOITDB text WORKING POC
IBM WebSphere Application Server <6.0 - Info Disclosure
IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine.