CVE-2026-2102

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

CVE-2026-2102

The wrensec-commons library contains a reflected cross-site scripting (XSS) vulnerability within the CREST framework's HTTP binding. The root cause is located in the HttpUtils.prepareResponse() method, which fails to properly sanitize the _mimeType request parameter when setting the Content-Type ...

CVE-2026-2102 XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

CVE-2026-2102 XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

EUVD-2026-115250

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

PT-2026-135490

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

Deserialization of untrusted data

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

CVE-2021-40376

otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attack may be possible as well, by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000...

CVE-2021-40376

otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attack may be possible as well, by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000...

Security Bulletin: Incorrect SSL protocol variant in SCA HTTP binding affecting WebSphere Enterprise Service Bus, WebSphere Process Server and IBM Business Process Manager Advanced (CVE-2014-6176)

Summary The HTTP import binding in an SCA module can be configured with a reference to a SSL configuration that exists on the application server. The HTTP binding uses always the SSLv3 protocol variant regardless of the SSL protocol setting in the referenced SSL configuration. Vulnerability Detai...