CVE-2019-2890

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Services. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via T3 to compromise Oracle...

Unspecified Vulnerability in Oracle WebLogic Server (CNVD-2019-36442)

Oracle WebLogic Server is a Java EE application server. An unspecified vulnerability exists in the Web Services component in Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0. An attacker could exploit this vulnerability to compromise confidentiality...

CVE-2019-2907: Undefined Security Weakness

Vulnerability in the Oracle Web Services product of Oracle Fusion Middleware component: SOAP with Attachments API for Java. The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web...

CVE-2019-2887: Undefined Security Weakness

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Services. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

Unspecified Vulnerability in Oracle WebLogic Server (CNVD-2019-36443)

Oracle WebLogic Server is a Java EE application server. An unspecified vulnerability exists in the Web Services component in Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0. An attacker could exploit this vulnerability to affect confidentiality, integrity, and availability...

CVE-2019-2890: Undefined Security Weakness

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Services. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via T3 to compromise Oracle...

PT-2019-3778

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 Description The issue is related to the Web Services component of Oracle WebLogic Server, which is part of Oracle Fusion Middleware. It allows a low-privileged attacker with...

Oracle Web Services CVE-2019-2907 Remote Security Vulnerability

Description Oracle Web Services is prone to a remote security vulnerability. The vulnerability can be exploited over the 'HTTP' protocol. The 'SOAP with Attachments API for Java' component is affected. This vulnerability affects the following supported versions: 12.2.1.3.0 Technologies Affected...

Oracle WebLogic Server Multiple Remote Security Vulnerabilities

Description Oracle WebLogic Server is prone to multiple remote security vulnerabilities. These vulnerabilities can be exploited over the 'HTTP' protocol. The 'Console', 'Web Services', 'EJB Container', and 'Web Services' components are affected. These vulnerabilities affect the following supporte...

PT-2019-3775

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 Description The issue is related to insufficient access control in the Web Services component of Oracle WebLogic Server, part of the Oracle Fusion Middleware platform. This can...

Imperva: Data Breach Caused by Amazon Cloud Misconfiguration

Imperva, the security vendor, said this week that a misconfiguration of an Amazon Web Services AWS cloud instance allowed hackers to exfiltrate information on customers using its Cloud Web Application Firewall WAF product. Formerly known as Incapsula, the Cloud WAF analyzes requests coming into...

Microsoft Browser Spoofing Vulnerability

A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with...

Cisco IOS XE Software Command Injection Vulnerability (cisco-sa-20190327-iosxe-cmdinj)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the Web Services Management Agent WSMA function of Cisco IOS XE Software. The vulnerability allows an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user...

USN-4135-2: Linux kernel vulnerabilities

Peter Pi discovered a buffer overflow in the virtio network backend vhostnet implementation in the Linux kernel. An attacker in a guest may be able to use this to cause a denial of service host OS crash or possibly execute arbitrary code in the host OS. CVE-2019-14835 It was discovered that the...

searchfxnet-lb-403591101.us-east-1.elb.amazonaws.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-954957 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

USN-4117-1: Linux kernel (AWS) vulnerabilities

It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the Linux kernel. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2019-10126 Amit Klein and Benny Pinkas discovered that the Linux kerne...

Capital One Hacker Also Accused of Hacking 30 More Companies and CryptoJacking

Former Amazon employee Paige Thompson, who was arrested last month in relation to the Capital One data breach, has been accused of hacking not only the U.S. credit card issuer, but also more than 30 other companies. An indictment unsealed on Wednesday revealed that Thompson not just stole data fr...

Security Bulletin: Information disclosure for IBM Infosphere Identity Insight

Summary There is a potential information disclosure vulnerability in Identity Insight when using web services. The information disclosure is due to an XML external entity XXE vulnerability. Vulnerability Details CVEID: CVE-2019-4433 DESCRIPTION: IBM InfoSphere Global Name Management is vulnerable...

Capital One Data Breach Affects 106 Million Customers; Hacker Arrested

Another week, another massive data breach. Capital One, the fifth-largest U.S. credit-card issuer and banking institution, has recently suffered a data breach exposing the personal information of more than 100 million credit card applicants in the United States and 6 million in Canada. The data...

The vulnerability of the Web Services Management Agent component of the Cisco Industrial Network Director software package allows a perpetrator to execute a type of attack known as “man-in-the-middle” attacks.

The vulnerability of the Web Services Management Agent component of the Cisco Industrial Network Director software package is related to errors in certificate verification for X.509 certificates. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” attack...