CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2026-105115

OpenAM versions prior to 16.1.3 are vulnerable to an unauthenticated arbitrary class instantiation vulnerability within the legacy JAX-RPC SOAP interface . Remote attackers can exploit this by sending SOAP requests to the */jaxrpc/ endpoint using an unverified session identifier and a specified c...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2023-20198

Resumen Este repositorio contiene un estudio de caso de ciberseguridad que analiza CVE-2023-20198, una vulnerabilidad crítica de día cero en el software Cisco IOS XE. El proyecto explora cómo se puede explotar la vulnerabilidad a través de la interfaz web y propone estrategias de mitigación...

asf__cxf_CVE-2016-6812_3-0-11

¡Bienvenido a Apache CXF! Apache CXF es un framework de servicios de código abierto. CXF te ayuda a construir y desarrollar servicios utilizando APIs de programación frontend, como JAX-WS y JAX-RS. Estos servicios pueden hablar una variedad de protocolos como SOAP, XML/HTTP, HTTP RESTful o CORBA ...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF lectura de archivos Exploit de prueba de concepto para CVE-2022-46364 — una vulnerabilidad de falsificación de solicitud del lado del servidor SSRF en el procesamiento de solicitudes MTOM/XOP de Apache CXF. Resumen de la vulnerabilidad CVE-2022-46364 afec...

SAP Solution Manager 7.2 - Remote Command Execution

SAP Solution Manager SolMan running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet tcsmdagentapplicationeem. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information...

CVE-2025-59287-WSUS-2

CVE-2025-59287 ⚠ Esta herramienta se crea únicamente con fines educativos. El uso no autorizado fuera de entornos controlados está estrictamente prohibido. CVE-2025-59287 es una vulnerabilidad crítica de ejecución remota de código en Microsoft Windows Server Update Services WSUS. Se origina por u...

PT-2026-104576

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/' using an unverified session...

CVE-2026-105115: Missing Authentication for Critical Function

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2025-49493

Exploit XXE de Akamai CloudTest CVE-2025-49493 Resumen Este es un exploit basado en Python para CVE-2025-49493 , que afecta a las versiones de Akamai CloudTest anteriores a 60 2025.06.02 12988. La vulnerabilidad permite la inyección de Entidad Externa XML XXE a través del endpoint del servicio...

POC-CVE-2026-56164-exploit

CVE-2026-56164 — Exploit de omisión de autenticación en Microsoft SharePoint Server Crítico CVSS 9.8 — Escalada de privilegios no autenticada a Administrador de granja en Microsoft SharePoint Server Tabla de contenidos Descripción general Detalles de la vulnerabilidad Versiones afectadas Diagrama...

CVE-2026-87830

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

CVE-2026-88920

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-79898

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

CVE-2026-79898 Fortra BoKS Manager crlserver command injection vulnerability

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

EUVD-2026-90875

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...