Description
Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2018-2639 Vulnerability (CVE-2018-2639)
WordPress Plugin WP Retina 2x Cross-Site Scripting (5.2.0)
WordPress Plugin Yahoo! Updates for WordPress Multiple Cross-Site Scripting Vulnerabilities (1.0)
PHP Other Vulnerability (CVE-2014-9425)
WordPress Plugin Quick Restaurant Menu Multiple Vulnerabilities (2.0.2)