9892 matches found
Apache Struts 2 REST Plugin XStream XML Request Deserialization RCE
The remote web application appears to use the Apache Struts 2 web framework. A remote code execution vulnerability exists in the REST plugin, which uses XStreamHandler to insecurely deserialize user-supplied input in XML requests. An unauthenticated, remote attacker can exploit this, via a...
Apache Struts 2 framework REST plugin insecurely deserializes untrusted XML data
Overview Apache Struts 2 framework, versions 2.5 to 2.5.12, with REST plugin insecurely deserializes untrusted XML data. A remote, unauthenticated attacker can leverage this vulnerability to execute arbitrary code in the context of the Struts application. Description CWE-502: Deserialization of...
Denial Of Service (DoS)
struts2-rest-plugin is vulnerable to denial of service DoS attacks. These attacks are possible because it is using a version of xwork-core that is vulnerable to CVE-2017-7957...
Remote Code Execution (RCE)
struts2-rest-plugin is vulnerable to remote code execution RCE attacks. The vulnerability exists as XStream objects are being deserialized without any type filtering...
CVE-2017-9805
The REST Plugin in Apache Struts2 is using a XStreamHandler with an instance of XStream for deserialization without any type filtering which could lead to Remote Code Execution when deserializing XML payloads. An attacker could use this flaw to execute arbitrary code or conduct further attacks...
Patch Released for Critical Apache Struts Bug
The Apache Software Foundation has patched a critical remote code execution vulnerability affecting all versions of the popular application development framework Struts since 2008. All web applications using the framework’s REST plugin are vulnerable. Users are advised to upgrade their Apache...
CVE-2017-9793
A flaw was found in the Struts REST plugin when using an outdated XStream library. An attacker could perform a denial of service attack using a malicious request with specially crafted XML payload...
PT-2017-2795
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.1 through 2.3.x before 2.3.34 Apache Struts versions 2.5.x before 2.5.13 Description The issue is related to the REST Plugin in Apache Struts, which uses an XStreamHandler with an instance of XStream for...
Huawei FusionSphere OpenStack Improper Authentication Vulnerability (CNVD-2017-30767)
Huawei FusionSphere OpenStack FSO is FusionSphere's cloud platform software for ICT scenarios. An improper authentication vulnerability exists in FusionSphere OpenStack. Due to improper authentication of the privileges of the accessing user, an attacker can perform additional operations after...
CVE-2017-9979
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary...
CVE-2017-9979
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary...
CVE-2017-9979
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary...
Drupal 8.x < 8.3.7 Multiple Vulnerabilities (SA-CORE-2017-004)
According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured ...
How To Automate Security Analysis with the RIPS API
RIPS API RIPS exposes a powerful REST-API, an interface specifically designed for developers and their applications. It is used to provide the web interface with analysis results, to start scans through plugins, to manage users, and much more. In short, the API enables easy automation of all RIPS...
PowerDNS dnsdist Authentication Bypass Vulnerability
dnsdist is a load balancer that diverts traffic to different servers to provide optimal performance for users. A security vulnerability exists in the REST API authentication mechanism in dnsdist version 1.1.0. An attacker can exploit the vulnerability to bypass access restrictions with the help o...
CVE-2017-7557
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...
Cross site request forgery (csrf)
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...
DEBIAN-CVE-2017-7557
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...