cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service DoS attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack...

Samsung Syncthru Web Service Cross-Site Request Forgery Vulnerability

Samsung Syncthru Web Service is a web-based synchronization service for printers from Samsung South Korea. A cross-site request forgery vulnerability exists in Samsung Syncthru Web Service version 4.05.61. A remote attacker can exploit this vulnerability to perform unauthorized operations...

Multiple Cross-Site Scripting Vulnerabilities in Samsung Syncthru Web Service

Samsung Syncthru Web Service is a web-based synchronization service for printers from Samsung South Korea. Multiple cross-site scripting vulnerabilities exist in Samsung Syncthru Web Service version 4.05.61. A remote attacker can exploit the vulnerabilities to inject arbitrary web script or HTML...

Samsung SyncThru Web Service Detection (HTTP)

HTTP based detection of Samsung SyncThru Web Service. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Samsung Syncthru Web Service Multiple Vulnerabilities (Jul 2018)

Samsung Syncthru Web Service is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-14904

Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFwpid...

CVE-2018-14908

Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printReportSetupView.sws for a "Print emails sent" action...

CVE-2018-14904

Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFwpid...

Cross site scripting

Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFwpid...

Cross site request forgery (csrf)

Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printReportSetupView.sws for a "Print emails sent" action...

CVE-2018-14908

Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printReportSetupView.sws for a "Print emails sent" action...

CVE-2018-14908

CVE-2018-14908 affects Samsung Syncthru Web Service v4.05.61. Multiple connected sources confirm a cross-site request forgery (CSRF) vulnerability that allows unauthorized operations on the web service, reportedly demonstrated via the sws.application/printinformation/printReportSetupView.sws endp...

CVE-2018-14904: Improper Neutralization of Input During Web Page Generation

Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFwpid...

PT-2018-12793

Name of the Vulnerable Software and Affected Versions Samsung Syncthru Web Service version V4.05.61 Description The issue concerns a CSRF vulnerability that affects every request. An example of this vulnerability is demonstrated by the "Print emails sent" action, which can be exploited through th...

CVE-2018-14908: Cross-Site Request Forgery (CSRF)

Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printReportSetupView.sws for a "Print emails sent" action...

PT-2018-12789

Name of the Vulnerable Software and Affected Versions Samsung Syncthru Web Service version V4.05.61 Description The issue concerns multiple unauthenticated XSS attacks. These attacks can be executed on several parameters, such as ruiFw pid. Recommendations For Samsung Syncthru Web Service version...

CVE-2018-10627

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can use the SOAP API to retrieve and change sensitive configuration items such as the usernames and passwords for the Web and FTP servers. This...

CVE-2018-2938

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Java DB. Supported versions that are affected are Java SE: 6u191, 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the...

CVE-2018-2938: Undefined Security Weakness

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Java DB. Supported versions that are affected are Java SE: 6u191, 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the...

CVE-2018-9070

For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides ext...