You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@tomcat.apache.org by Jon Stevens <jo...@latchkey.com> on 2001/04/02 08:45:08 UTC

FW: regards from lovehacker

----------
From: "lovehacker" <lo...@263.net>
Date: Mon, 2 Apr 2001 14:39:08 +0800
To: <jo...@latchkey.com>
Subject: regards from lovehacker

hi jon:
>#1. Please report security issues to security@apache.org
>and/or tomcat-dev@jakarta.apache.org first. It seems
>like that is a common courtesy.

I am very sorry!
i will report security issues to security@apache.org first time.

Tomcat 4.0-b2 Vulnerability look at this:
http://Tomcat4.0-b2:8080/examples/jsp/snp/snoop%252ejsp "%252e" like "."
or
http://Tomcat4.0-b2:8080/examples/jsp/snp/snoop.jsp%2581 "%2581" like "?"
or 
http://Tomcat4.0-b2:8080/examples/jsp/snp/snoop.js%2570 "%2570" like "p"

lovehacker
China Network Security League
http://www.chinansl.com
lovehacker@chinansl.com