UBUNTU-CVE-2015-0226

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this...

Access Bypass

Drupal is vulnerable to access bypass. Malicious users are able to leverage the REST API to post approved comments regardless of their permission level. This only affects applications which have the RESTful web services enabled...

OpenJDK: unbounded memory allocation in JAXWSExceptionBase deserialization (JAX-WS, 8181100)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JAX-WS. Supported versions that are affected are Java SE: 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protoco...

Design/Logic Flaw

Vulnerability in the Oracle Engineering Data Management component of Oracle Supply Chain Products Suite subcomponent: Web Services Security. Supported versions that are affected are 6.1.3.0 and 6.2.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTT...

CVE-2017-10161

Vulnerability in the Oracle Engineering Data Management component of Oracle Supply Chain Products Suite subcomponent: Web Services Security. Supported versions that are affected are 6.1.3.0 and 6.2.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTT...

CVE-2017-10161

CVE-2017-10161 affects Oracle Engineering Data Management in the Oracle Supply Chain Products Suite (Web Services Security). Affected versions are 6.1.3.0 and 6.2.2.0. The vulnerability can be exploited by an unauthenticated attacker over HTTP to perform unauthorized update, insert, or delete ope...

CVE-2017-10352: Undefined Security Weakness

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services. The supported version that is affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with netwo...

PT-2017-11153

Name of the Vulnerable Software and Affected Versions Oracle Engineering Data Management versions 6.1.3.0 and 6.2.2.0 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Engineering Data Management. Successful attacks can result in unauthoriz...

CVE-2017-10161: Undefined Security Weakness

Vulnerability in the Oracle Engineering Data Management component of Oracle Supply Chain Products Suite subcomponent: Web Services Security. Supported versions that are affected are 6.1.3.0 and 6.2.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTT...

UBUNTU-CVE-2017-10350

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JAX-WS. Supported versions that are affected are Java SE: 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protoco...

Oracle Secure Global Desktop Web Services Component Remote Authentication Bypass (October 2017 CPU)

The version of Oracle Secure Global Desktop installed on the remote host is 5.3 and is missing a security patch from the October 2017 Critical Patch Update CPU. It is, therefore, affected by an Apache HTTP server remote authentication bypass vulnerability in the web services component. The Apache...

Top 10 Things CSPs Need to Know about FedRAMP Authorization on Amazon Web Services

Coalfire conducted a webinar, FedRAMP on AWS: What you need to know. The discussion covered what cloud service providers need to know when pursuing FedRAMP authorization leveraging AWS U.S East/West or GovCloud. Below youll find the Top 10 things that cloud service providers should know...

Oracle Supply Chain Products Suite Information Disclosure Vulnerability (CNVD-2017-30732)

Oracle Supply Chain Products Suite is the Oracle Supply Chain Products Suite. A security vulnerability exists in the Web Services Security component of Oracle Agile Engineering Data Management for Oracle Supply Chain Products Suite, which can be exploited by attackers to compromise the...

Java SE and Java SE Embedded Denial of Service Vulnerabilities

Oracle Java SE and Java SE Embedded are both products of Oracle Corporation. Java SE Java Platform Standard Edition is used to develop and deploy Java applications for desktops, servers, as well as embedded devices and real-time environments; Java SE Embedded is a Java platform for the developmen...

Medical Records and Sensitive Data of 150,000 US Patients Exposed

By Uzair Amir Its another day with yet another Amazon Web Services AWS This is a post from HackRead.com Read the original post: Medical Records and Sensitive Data of 150,000 US Patients Exposed...

Apache OpenMeetings Web Services Detection

This host is running Apache OpenMeetings, a software used for presenting, online training, web conferencing, collaborative whiteboard drawing and document editing, and user desktop sharing. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced...

BSA-2017-432

Security Advisory ID : BSA-2017-432 Component : JOBSS Revision : 2.0: Interim Red HatJBossEAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact. Affected Products Brocade is investigating...

Multiple DenyAll Product Authentication Vulnerabilities

DenyAll i-Suite LTS and others are Web firewall products from DenyAll France. An authentication vulnerability exists in several DenyAll products. A remote attacker can exploit this vulnerability by sending a typeOf=debug request to the /webservices/download/index.php file and reading the iToken...

Massive Viacom Data Exposed Through Amazon Web Services

By Waqas Database on Amazon Web Services Containing Sensitive Data of Viacom This is a post from HackRead.com Read the original post: Massive Viacom Data Exposed Through Amazon Web Services...

Thousands of Elasticsearch Servers Hijacked to Host PoS Malware

Thousands of insecure Elasticsearch servers are hosting point-of-sale malware, according to an analysis by Kromtech Security Center. In total, researchers found 15,000 insecure Elasticsearch servers with 27 percent 4,000 hosting the PoS malware strains Alina and JackPoS. “The absence of...