RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2019-018

This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2019-003

Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services rest module enabled and allows GET, PAT...

[SECURITY] [DLA 1681-1] gsoap security update

Package : gsoap Version : 2.8.17-1+deb8u2 CVE ID : CVE-2019-7659 It was discovered that there was a denial of service vulnerability in gsoap a C/C++ language binding used for SOAP-based web services. For Debian 8 "Jessie", this issue has been fixed in gsoap version 2.8.17-1+deb8u2. We recommend...

Debian: Security Advisory (DLA-1681-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the WLS component – the Web Services server of Oracle WebLogic Server – allows a perpetrator to gain access to protected information.

The vulnerability of the WLS component—the Web Services server of Oracle WebLogic Server—is related to insufficient access control. Exploiting this vulnerability could allow an attacker operating remotely to gain access to protected information using the HTTP protocol...

Microsoft Browser Spoofing Vulnerability

A spoofing vulnerability exists when Microsoft browsers improperly handles specific redirects. An attacker who successfully exploited this vulnerability could trick a user into believing that the user was on a legitimate website. The specially crafted website could either spoof content or serve a...

The vulnerability of the WLS component – the Web Services server of Oracle WebLogic Server – allows a perpetrator to gain access to protected information.

The vulnerability of the WLS component—the Web Services server of Oracle WebLogic Server—is related to insufficient access control. Exploiting this vulnerability could allow an attacker to gain access to protected information using the HTTP protocol...

The vulnerability of the WLS component – the Web Services server of Oracle WebLogic Server – allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the WLS component—the Web Services server of Oracle WebLogic Server—is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

The vulnerability of the WLS component – the Web Services server of Oracle WebLogic Server – allows a perpetrator to gain access to protected information.

The vulnerability of the WLS component—the Web Services server of Oracle WebLogic Server—is related to insufficient access control. Exploiting this vulnerability could allow an attacker operating remotely to gain access to protected information using the HTTP protocol...

Security Updates for Exchange (February 2019)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - Multiple Vulnerabilites with the included libraries from Oracle Outside. CVE-2018-18223, CVE-2018-18224, CVE-2018-3147, CVE-2018-3217, CVE-2018-3218,...

Oracle WebLogic Web Services Test Client Detection

Binary data oracleweblogicwebservicestestclient.nbin...

GHSA-8222-6FC8-MHVF Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3773

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3773

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Xxe

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3773

CVE-2019-3773 affects Spring Web Services (versions 2.4.3, 3.0.4, and other older, unsupported lines) and is due to XML External Entity (XXE) injection when processing XML from untrusted sources. The issue is rated high/critical (CVSSv3 9.8, network attack, unauthenticated, with high impact to co...

CVE-2019-3773

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

The vulnerability of the galsrv.exe process in the Enterprise Resource Management System “Galaktika ERP” allows a attacker to cause a service failure.

The vulnerability of the galsrv.exe process in the Enterprise Resource Management System “Galaktika ERP” is related to resource management errors. Exploiting this vulnerability allows a malicious actor to cause service failures for DCOM-based technologies by quickly sending specially crafted...

CVE-2019-3773: Improper Restriction of XML External Entity Reference

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...