Design/Logic Flaw

HTTP methods reveled in Web services vulnerability in Micro Focus Service manager server, affecting versions 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The vulnerability could be exploited to allow exposure of configuration data...

CVE-2020-9519

HTTP methods reveled in Web services vulnerability in Micro Focus Service manager server, affecting versions 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The vulnerability could be exploited to allow exposure of configuration data...

CVE-2020-9519

The CVE-2020-9519 entry concerns Micro Focus Service Manager (server) with an exposure of configuration data. Affected versions are 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, and 9.63. The documents indicate the issue arises from handling HTTP methods in web services, enabling partial confid...

CVE-2020-9519: Undefined Security Weakness

HTTP methods reveled in Web services vulnerability in Micro Focus Service manager server, affecting versions 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The vulnerability could be exploited to allow exposure of configuration data...

PT-2020-20709

Name of the Vulnerable Software and Affected Versions Micro Focus Service Manager versions 9.40 through 9.63 Description The issue concerns a Web services vulnerability in the server component, where HTTP methods are revealed, potentially allowing the exposure of configuration data. Recommendatio...

CVE-2019-19611

An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1...

CVE-2019-19611

An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1...

CVE-2019-19611

Affected product: Halvotec RaQuest 10.23.10801.0. Vulnerability: an exposed web service allows an anonymous user to access the list of connected users and their session cookies (information disclosure). Root cause / details: the initial documents state the issue but do not provide deeper technica...

PT-2020-10198

Name of the Vulnerable Software and Affected Versions Halvotec RaQuest versions prior to 10.24.11206.1 Description An issue was discovered that allows an anonymous user to access the list of connected users as well as the session cookie for each user through one of the exposed web services...

CVE-2020-9435

PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices contain a hardcoded certificate and ke...

CVE-2020-9435

PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices contain a hardcoded certificate and ke...

The vulnerability of Apache CXF web services, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of Apache CXF web services is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to trigger a service failure by sending a specially crafted message, whose embedded data exceeds the allowed limit...

PT-2020-7102 · Red Hat +1 · Redhat Jboss Middleware +9

Name of the Vulnerable Software and Affected Versions: Apache WSS4J versions prior to 1.6.5 JBossWS affected versions not specified Redhat JBoss Business Rules Management System affected versions not specified Redhat JBoss Enterprise Application Platform affected versions not specified Redhat JBo...

CVE-2020-9044

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...

CVE-2020-9044 Metasys Improper Restriction of XML External Entity Reference

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...

CVE-2020-9044: Improper Restriction of XML External Entity Reference

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...

PT-2020-20457

Name of the Vulnerable Software and Affected Versions Metasys Application and Data Server ADS, ADS-Lite versions prior to 10.1 Metasys Extended Application and Data Server ADX versions prior to 10.1 Metasys Open Data Server ODS versions prior to 10.1 Metasys Open Application Server OAS version 10...

Citrix Gateway Cache Overflow Vulnerability

Citrix Gateway is a customer-managed solution that can be deployed locally or on any public cloud, such as AWS, Azure or Google Cloud Platform. Citrix Gateway has a security vulnerability. An attacker can exploit the vulnerability to cache poisoning...

The vulnerability of the OpenId Connect service’s framework for Apache CXF allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the OpenId Connect service for Apache CXF web services is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

U.S. Dept Of Defense: SharePoint Web Services Exposed to Anonymous Access Users

Summary: Any unauthenticated/anonymous users are able to access the SharePoint Web Services .wsdl files for the █████ Initiative website. Description: The SharePoint installation for this particular site allows any user to access the spdisco.aspx on the web server which discloses the location of ...