The vulnerability of the galsrv.exe process in the Enterprise Resource Management System “Galaktika ERP” allows a attacker to cause a service failure.

The vulnerability of the galsrv.exe process in the Enterprise Resource Management System “Galaktika ERP” is related to resource management errors. Exploiting this vulnerability allows a malicious actor to cause service failures for DCOM-based technologies by quickly sending specially crafted...

Design/Logic Flaw

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE...

CVE-2018-20733

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE...

CVE-2018-20733

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE...

CVE-2018-20733

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE...

CVE-2018-20733

The vulnerability CVE-2018-20733 affects SAS Web Infrastructure Platform’s BI Web Services prior to 9.4M6. The root issue is an XML External Entity (XXE) exposure within BI Web Services, potentially impacting confidentiality as indicated by CVSS metrics (C: Partial, A: None, I: None for CVSS2; C:...

CVE-2018-20733: Improper Restriction of XML External Entity Reference

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE...

PT-2019-10192

Name of the Vulnerable Software and Affected Versions: SAS Web Infrastructure Platform versions prior to 9.4M6 Description: The issue affects BI Web Services in SAS Web Infrastructure Platform, allowing XXE XML External Entity attacks. Recommendations: For versions prior to 9.4M6, update to versi...

CVE-2018-18812

The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when th...

CVE-2019-2395

CVE-2019-2395 affects Oracle WebLogic Server (WLS – Web Services subcomponent) in Oracle Fusion Middleware, specifically the 10.3.6.0 release. The vulnerability is described as easily exploitable with network access via HTTP by a low-privilege attacker, potentially leading to unauthorized read ac...

Unspecified Vulnerability in Oracle WebLogic Server (CNVD-2019-27115)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. WebLogic Server is one of the application server components for cloud and traditional...

CVE-2019-2395: Undefined Security Weakness

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services. The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2017-6921 File REST resource does not properly validate

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services rest module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or...

CVE-2017-6921

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services rest module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or...

CVE-2017-6924

In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services rest module enabled, the...

PT-2019-8592

Name of the Vulnerable Software and Affected Versions Drupal 8 versions prior to 8.3.4 Description The issue arises from improper validation of certain fields when manipulating files through the file REST resource. This affects sites with the RESTful Web Services rest module enabled, where the fi...

CVE-2017-6921: Improper Input Validation

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services rest module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or...

CVE-2017-6924: Improper Privilege Management

In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services rest module enabled, the...

XML External Entity Injection (XXE)

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Epson WorkForce WF-2861 Firmware Update License Vulnerability

The Epson WorkForce WF-2861 is a Wi-Fi duplex MFP inkjet printer. A firmware update authorization vulnerability exists in the Web services of the Epson WorkForce WF-2861 10.48 LQ22I3 recovery mode, WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA. A remote attacker can exploit this vulnerability to...