Genivia gSOAP 代码问题漏洞

gSOAP is a C/C++ library for developing XML-based Web services . A null pointer dereference vulnerability exists in the WS-Security plug-in feature of Genivia gSOAP 2.8.107. An attacker could exploit this vulnerability by sending a specially crafted SOAP request to cause a denial of service...

Genivia gSOAP WS-Security plugin denial-of-service vulnerability

Summary A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions Genivia gSOAP 2.8.107 Product URLs...

PT-2020-6540 · Gsoap · Gsoap

Name of the Vulnerable Software and Affected Versions: gSOAP version 2.8.107 Description: A denial-of-service issue exists in the WS-Security plugin functionality of gSOAP. This issue can be triggered by a specially crafted SOAP request, leading to denial of service. An attacker can exploit this ...

PT-2020-6526 · Genivia · Gsoap

Name of the Vulnerable Software and Affected Versions: Genivia gSOAP version 2.8.107 Description: A denial-of-service issue exists in the WS-Security plugin functionality of Genivia gSOAP. This is due to pointer dereference errors when processing SOAP requests. An attacker can exploit this by...

CVE-2014-0245

It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain...

Information disclosure

It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain...

CVE-2014-0245

The CVE-2014-0245 issue affects GateIn WSRP’s GTNSubjectCreatingInterceptor in gatein-wsrp, where non-thread-safe handling under high concurrency can allow an unauthenticated remote attacker to disclose privileged information when WS-Security is enabled for the WSRP Consumer, for a specific endpo...

WSS4JInInterceptor Bypasses WS Security Processing

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

Potential security vulnerability with IBM WebSphere Application Server

Abstract Security Bulletin: Asset and Service Management Products - Potential security exposure when using WS-Security, with either JAX-WS or JAX-RPC, resulting in a user gaining elevated privileges CVE-2011-1377. Content VULNERABILITY DETAILS: CVE ID: CVE-2011-1377 DESCRIPTION: Websphere...

Security Bulletin: Possible security exposure with WebSphere Application Server with WS-Security enabled applications using LTPA tokens (PM43585/PM43792/PM45181)

Summary There is a possible security exposure when using WS-Security resulting in a user gaining elevated privileges. This impacts applications using either JAX-WS and JAX-RPC. Vulnerability Details WebSphere Application Server could provide weaker than expected security when using web services...

Security Bulletin: Potential Security Vulnerabilites fixed in IBM WebSphere Application Server 8.0.0.8

Summary Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.0.0.8 Vulnerability Details CVE ID:CVE-2013-0460PM72275 DESCRIPTION: WebSphere Application Server could be vulnerable to a cross-site request forgery, caused by improper validation of portlets in...

Information Disclosure

Apache cxf-rt-ws-security is vulnerable to information disclosure. A malicious user can pass a malicious delegation token to the application, causing the application to return a cached token from another user...

IBM WebSphere Application Server 7.0 < Fix Pack 31 Multiple Vulnerabilities

IBM WebSphere Application Server 7.0 before Fix Pack 31 appears to be running on the remote host. It is, therefore, potentially affected by the following vulnerabilities : - A flaw in the modrewrite module of Apache HTTP Server potentially allows a remote attacker to execute arbitrary code via...

IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.1 Multiple Vulnerabilities

IBM WebSphere Application Server 8.5 before Fix Pack 8.5.5.1 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities : - A flaw exists related to Apache Ant and file compression that could lead to denial of service conditions. CVE-2012-209...

CVE-2013-4053

The WS-Security implementation in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack for Web Services 6.1 before 6.1.0.47, when a trust store is configured for XML Digital Signatures, does not properly...

Code injection

The WS-Security implementation in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack for Web Services 6.1 before 6.1.0.47, when a trust store is configured for XML Digital Signatures, does not properly...

CVE-2013-4053

The WS-Security implementation in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack for Web Services 6.1 before 6.1.0.47, when a trust store is configured for XML Digital Signatures, does not properly...

CVE-2013-4053

CVE-2013-4053 refers to IBM WebSphere Application Server WS-Security with XML Digital Signature using a trust store, where improper certificate verification could let a remote attacker gain privileged access. Affected products/versions include WebSphere Application Server 8.5, 8.0, 7.0, and 6.1 (...

IBM WebSphere Application Server 6.1 < Fix Pack 47 Multiple Vulnerabilities

IBM WebSphere Application Server 6.1 before Fix Pack 47 appears to be running on the remote host. As such, it is potentially affected by the following vulnerabilities : - A remote attacker can bypass authentication because of improper user validation on Linux, Solaris, and HP-UX platforms that us...

IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5 Multiple Vulnerabilities

IBM WebSphere Application Server 8.5 before Fix Pack 8.5.5 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities : - The TLS protocol in the GSKIT component is vulnerable to a plaintext recovery attack. CVE-2013-0169, PM85211 - The...