CVE-2025-32784 conda-forge-webservices has an Unauthorized Artifact Modification Race Condition

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized a...

CVE-2025-32784

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized a...

PT-2025-16541 · Conda Forge · Conda-Forge-Webservices

Name of the Vulnerable Software and Affected Versions: conda-forge-webservices versions prior to 2025.4.10 Description: A Time-of-Check to Time-of-Use TOCTOU issue has been identified in the conda-forge-webservices component, which can be exploited to introduce unauthorized modifications to build...

conda-forge-webservices security vulnerabilities

conda-forge-webservices is a conda-forge open source web application deployed to run condaforge management commands and linting. A security vulnerability exists in versions of conda-forge-webservices prior to 2025.4.10 that stems from a competitive condition and could lead to the release of a...

CVE-2025-32784: Time-of-check Time-of-use (TOCTOU) Race Condition

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized a...

cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding

A server-side request forgery SSRF vulnerability was found in Apache CXF. This issue occurs in attacks on webservices that take at least one parameter of any type, and when Aegisdatabind is used. Users of other data bindings including the default databinding are not impacted...

VulnCheck KEV: CVE-2023-3368

Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960...

Apache CXF < 3.5.9, 3.6.x < 3.6.4, 4.0.x < 4.0.5 Multiple Vulnerabilities

The version of Apache CXF installed on the remote Windows host is affected by multiple vulnerabilities: - A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only...

CVE-2024-29736

A Server-side request forgery SSRF vulnerability was found in Apache CXF in the WADL service description. The flaw allows an attacker to perform SSRF-style attacks on REST web services. The attack only applies if a custom stylesheet parameter is configured. Mitigation Mitigation for this issue is...

Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured...

CVE-2024-29736 Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured...

CVE-2024-29736: Server-Side Request Forgery (SSRF)

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured...

cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding

A server-side request forgery SSRF vulnerability was found in Apache CXF. This issue occurs in attacks on webservices that take at least one parameter of any type, and when Aegisdatabind is used. Users of other data bindings including the default databinding are not impacted...

CVE-2024-5202

Arbitrary File Read in OpenText Dimensions RM allows authenticated users to read files stored on the server via webservices...

CVE-2024-5202 Dimensions RM - Arbitrary File Read

Arbitrary File Read in OpenText Dimensions RM allows authenticated users to read files stored on the server via webservices...

CVE-2024-5202: Exposure of Sensitive Information to an Unauthorized Actor

Arbitrary File Read in OpenText Dimensions RM allows authenticated users to read files stored on the server via webservices...

PT-2024-35096 · Opentext · Opentext Dimensions Rm

Name of the Vulnerable Software and Affected Versions: OpenText Dimensions RM affected versions not specified Description: The issue allows authenticated users to read files stored on the server via webservices, potentially leading to unauthorized access to sensitive information. Recommendations:...

CVE-2024-33891: Use of Hard-coded Cryptographic Key

Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute...

org.wildfly.security:wildfly-elytron (1.20.2.final), org.wildfly:wildfly-naming (27.0.0.beta1) +1 more potentially affected by CVE-2023-6236 via org.wildfly.security:wildfly-elytron-http-oidc (1.20.2.final)

org.wildfly.security:wildfly-elytron-http-oidc MAVEN version 1.20.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.security:wildfly-elytron-http-oidc and may be impacted: - org.wildfly.security:wildfly-elytron 1.20.2.final -...

CVE-2024-28752

A server-side request forgery SSRF vulnerability was found in Apache CXF. This issue occurs in attacks on webservices that take at least one parameter of any type, and when Aegisdatabind is used. Users of other data bindings including the default databinding are not impacted. Mitigation No...