tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

RHEL 8 : pki-deps:10.6 (RHSA-2019:1529)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1529 advisory. The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by Red Hat...

tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

Insecure Defaults

cfme is vulnerable to insecure defaults. The vulnerability exists as the customization template in Red Hat CloudForms 3.1 Management Engine CFME 5.3 uses a default password for the root account when a password is not specified for a new image, which allows remote attackers to gain privileges...

Insecure Defaults

openshift-origin-broker is vulnerable to insecure defaults. The vulnerability exists as it was discovered that openshift-origin-broker configured several default user names and passwords for services if no user name or password was specified during installation. A remote attacker could use these...

GHSA-R4X2-3CQ5-HQVP The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

CVE-2018-15386

A vulnerability in Cisco Digital Network Architecture DNA Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default configuration of the affected system. An...

RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 4 (RHSA-2018:2469)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2469 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the...

tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

Insecure Defaults

apache-airflow is vulnerable to insecure defaults. The library uses a default SECRETKEY parameter that is the same for all installations, allowing a malicious user to create an authentic session to the application if the SECRETKEY wasn't changed...

Insecure Defaults

tomcat-websocket is vulnerable to missing hostname verification. The application does not verify the hostname with a client when establishing a TLS connection through the websocket, allowing a malicious user to impersonate a different host machine...

Oracle Fusion Middleware 12c (12.2.1.3.0) WebLogic SAML Issues

Oracle WebLogic - Multiple SAML Vulnerabilities CVE-2018-2998/CVE-2018-2933 Release URL: https://pulsesecurity.co.nz/advisories/WebLogic-SAML-Vulnerabilities Date Released: 18/07/2018 CVE: CVE-2018-2998 CVE-2018-2933 Author: Denis Andzakovic Vendor Website: http://www.oracle.com Affected Software...

XML External Entity (XXE)

phpoffice/common is vulnerable to XML external entity XXE attacks. The vulnerability exists due to the insecure defaults where external entities were allowed, making XXE attacks possible...

Fixed in Apache Tomcat 8.0.53

Low: host name verification missing in WebSocket client CVE-2018-8034 The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. This was fixed in revision 1833759. This issue was reported publicly on 11 June 2018 and formally announced as a...

Insecure Defaults

Apache Tomcat is vulnerable to insecure defaults. The CORS filter provided by default is insecure as it enables supportsCredentials for all origins. This can allow a malicious user unauthorized access to sensitive resources...

Insecure Defaults

Apache Derby is vulnerable to insecure defaults. An attacker can send network packets to a Derby Network Server to maliciously boot a database under their control control. The attack is only possible when the Java Security Manager policy file permits the reading of database locations, which is th...

Information Disclosure Through Insecure Defaults

github.com/heketi/heketi is vulnerable to information disclosure through insecure defaults. The application by default sets the /etc/heketi/heketi.json as world readable, allowing a malicious user to access sensitive information contained in it such as passwords...

XML External Entity (XXE) Injection Through Insecure Defaults

dom4j is vulnerable to XML External Entity Injection. The library by default uses the SAXReader to parse documents without using the setFeature function in it to disable doctype and entities, allowing a malicious user to pass a document to execute an XML Injection attack...

Insecure Defaults

akka-actor has insecure defaults. An attacker can leverage an ActorSystem exposed over TCP to perform Java deserialization attacks. By default Java deserialization is enabled and the documentation wasn't complete on how to disable the function.These attacks can be performed if the ActorSystem has...