[SECURITY] Fedora 17 Update: axis-1.4-19.fc17

Apache AXIS is an implementation of the SOAP "Simple Object Access Protoco l" submission to W3C. From the draft W3C specification: SOAP is a lightweight protocol for exchange of information in a decentraliz ed, distributed environment. It is an XML based protocol that consists of three parts: an...

Portable SDK for UPnP Devices (libupnp) contains multiple buffer overflows in SSDP

Overview The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Description Universal Plug and Play UPnP is a set of...

Axis Commerce 0.8.7.2 Cross Site Scripting Vulnerability

Axis Commerce version 0.8.7.2 suffers from multiple stored cross site scripting vulnerabilities. Axis Commerce 0.8.7.2 Remote Script Insertion Vulnerabilities alert'XSS';", "base":"TESTSTRING",...

Axis Commerce 0.8.7.2 Cross Site Scripting

Axis Commerce 0.8.7.2 Remote Script Insertion Vulnerabilities alert'XSS';", "base":"TESTSTRING", "secure":"TESTSTRING2", "rootcategory":"2"' / input type="hidden" name="a...

Axis Commerce 0.8.7.2 Remote Script Insertion Vulnerabilities

Summary Powerful open source ecommerce platform. Description Axis Commerce suffers from multiple stored XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and...

CVE-2012-5784

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

DEBIAN-CVE-2012-5784

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

CVE-2012-5784

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

Design/Logic Flaw

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

CVE-2012-5784

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

CVE-2012-5784

The CVE-2012-5784 issue concerns Apache Axis 1.4 and earlier, where the getCN/subjectAltName validation is missing, allowing MITM with arbitrary valid certificates. The flaw affects Axis-based components (e.g., PayPal-related integrations and JMS in ActiveMQ) and has led to multiple advisories (i...

CVE-2012-5784

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

Axis VoIP Manager v2.1.5.7 - Multiple Web Vulnerabilities

Title: ====== Axis VoIP Manager v2.1.5.7 - Multiple Web Vulnerabilities Date: ===== 2012-09-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=686 VL-ID: ===== 686 Common Vulnerability Scoring System: ==================================== 2.3 Introduction: =============...

Axis VoIP Manager 2.1.5.7 Cross Site Scripting

Title: ====== Axis VoIP Manager v2.1.5.7 - Multiple Web Vulnerabilities Date: ===== 2012-09-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=686 VL-ID: ===== 686 Common Vulnerability Scoring System: ==================================== 2.3 Introduction: =============...

HP SiteScope Remote Code Execution

This module exploits a code execution flaw in HP SiteScope. It exploits two vulnerabilities in order to get its objective. An authentication bypass in the create operation, available through the APIPreferenceImpl AXIS service, to create a new account with empty credentials and, subsequently, uses...

Axis VoIP Manager v2.1.5.7 - Multiple Web Vulnerabilities

Document Title: =============== Axis VoIP Manager v2.1.5.7 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=686 Release Date: ============= 2012-08-16 Vulnerability Laboratory ID VL-ID: ==================================== 6...

Axis VoIP Manager v2.1.5.7 - Multiple Web Vulnerabilities

Document Title: =============== Axis VoIP Manager v2.1.5.7 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=686 Release Date: ============= 2012-08-16 Vulnerability Laboratory ID VL-ID: ==================================== 6...

Yahoo Includes Private Key in Source File For Axis Chrome Extension

Yahoo on Wednesday launched a new browser called Axis and researchers immediately discovered that the company had mistakenly included its private signing key in the source file, a serious error that would allow an attacker to create a malicious, signed extension for a browser that the browser wil...

Axis M10 Series Network Cameras - Cross-Site Scripting

source: https://www.securityfocus.com/bid/50968/info Axis M10 Series Network Cameras are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Axis M10 Series Network Cameras - Cross-Site Scripting

Axis M10 Series Network Cameras - Cross-Site Scripting source: https://www.securityfocus.com/bid/50968/info Axis M10 Series Network Cameras are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execu...