Security Bulletin: Deserialization of Untrusted Data in Apache Axis2 affects AS4 of IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-66713)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-66713 DESCRIPTION: Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java...

Insecure Deserialization

Apache Axis2/Java is vulnerable to Insecure Deserialization. The vulnerability is due to deserialization of untrusted data in the Tribes-based clustering component, where crafted serialized Java objects received over the clustering channel can trigger arbitrary code execution by unauthenticated...

Apache Axis2 - xsd Path Traversal Detection

Detects Axis2 service ?xsd=../conf/axis2.xml traversal by matching axisconfig AxisJava2.0 in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Axis2 ?xsd= path traversal to axis2.xml.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713: Deserialization of Untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (>=1.2.0, <=1.3.0) +3 more potentially affected by CVE-2026-54475 via org.apache.activemq:apache-activemq (>=4.1.1, <=5.0.0)

org.apache.activemq:apache-activemq MAVEN version =4.1.1, =1.2.0, =1.1.0, =1.3.0 - org.apache.camel:camel-example-spring 1.2.0 - org.apache.camel:camel-example-spring-xquery 1.3.0 Source cves: CVE-2026-54475 Source advisory: MEND:CVE-2026-54475...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=2.9.3), com.apigee.registry.config:apigee-registry-maven-plugin (>=1.0.0-beta, <=1.0.2) +43 more potentially affected by CVE-2026-42404 via org.apache.neethi:neethi (2.0.2)

org.apache.neethi:neethi MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.neethi:neethi and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin =1.0, =1.0.0-beta, =1.0.0, =1.0.0, =2.5.2 -...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=2.9.3), com.apigee.registry.config:apigee-registry-maven-plugin (>=1.0.0-beta, <=1.0.2) +43 more potentially affected by CVE-2026-42403 via org.apache.neethi:neethi (2.0.2)

org.apache.neethi:neethi MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.neethi:neethi and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin =1.0, =1.0.0-beta, =1.0.0, =1.0.0, =2.5.2 -...

EUVD-2012-5976

Malware in sbrugna...

EUVD-2022-1896

Malicious code in bioql PyPI...

EUVD-2022-2731

Malicious code in bioql PyPI...

EUVD-2022-5659

Malicious code in bioql PyPI...

EUVD-2022-3150

Malicious code in bioql PyPI...

Apache Axis2 Brute Force Utility

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/axis2' require 'metasploit/framework/credentialcollection' class MetasploitModule 'Apache Axis2 Brute Force Utility',...

Apache Axis2 1.4.1 Local File Inclusion

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Axis2 v1.4.1 Local File Inclusion', 'Description' = %q This module exploits an Apache Axis2 v1.4.1 local file inclusion LFI vulnerability...

SUSE CVE-2012-4418

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

Security Bulletin: IBM SPSS Modeler Premium - Text Analytics SSL Spoofing (CVE-2012-5785)

Abstract Last updated on December 11, 2012. When using the Text Analytics Server from the IBM SPSS Modeler Premium product with the SSL option enabled default is disabled, then an SSL connection can be established without verifying the hostname of the target connection against the name on the SSL...

Security Bulletin: Apache Axis2 related vulnerability for IBM Tivoli Directory Integrator (CVE-2012-5785)

Abstract Apache Axis2 SSL vulnerability for IBM Tivoli Directory Integrator Content VULNERABILITY DETAILS: DESCRIPTION: Axis2 implemented in Java is vulnerable to man-in-the-middle attacks. By extension, all applications using this library to establish SSL connections with the target servers may ...

Security Bulletin: InfoSphere Guardium Data Redaction affected by SSL vulnerability in Apache Axis2 (CVE-2012-5785)

Abstract An SSL vulnerability exists in Apache Axis which is used by InfoSphere Guardium Data Redaction to process HTTPS requests from the Redaction SOAP API . Content VULNERABILITY DETAILS: CVE ID: CVE-2012-5785 DESCRIPTION: Apache Axis2/Java, as used in multiple products, could allow a remote...

Apache Axis2 Vulnerable to XML Signature wrapping attack

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...