iDS6 DSSPro Digital Signage System 6.2 - Improper Access Control Privilege Escalation

Exploit Title: iDS6 DSSPro Digital Signage System 6.2 - Improper Access Control Privilege Escalation Date: 2020-07-16 Exploit Author: LiquidWorm Vendor Homepage: http://www.yerootech.com Version: 6.2 iDS6 DSSPro Digital Signage System 6.2 Improper Access Control Privilege Escalation Vendor:...

Man-in-the-middle attack in Apache Axis

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

Improper Input Validation

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

Oracle WebCenter Portal Multiple Vulnerabilities (Jul 2020 CPU)

Binary data oraclewebcenterportalcpujul2020.nbin...

QRadar Community Edition 7.3.1.6 CSRF / Weak Access Control Vulnerability

QRadar Community Edition version 7.3.1.6 suffers from cross site request forgery and weak access control vulnerabilities. ------------------------------------------------------------------------ Cross-Site Request Forgery & weak access control in QRadar ConfigServices webservice...

QRadar Community Edition 7.3.1.6 Server Side Request Forgery Vulnerability

QRadar Community Edition version 7.3.1.6 has an issue where the RssFeedItem class of the QRadar web application is used to fetch and parse RSS feeds. No validation is performed on the user-supplied RSS feed URL. Due to the lack of URL validation whitelisting, it is possible for authenticated...

QRadar Community Edition 7.3.1.6 CSRF / Weak Access Control

------------------------------------------------------------------------ Cross-Site Request Forgery & weak access control in QRadar ConfigServices webservice ------------------------------------------------------------------------ Yorick Koster, September 2019...

Oracle Application Testing Suite (Apr 2020 CPU)

The version of Oracle Application Testing Suite installed on the remote host is affected by a Server Side Request Forgery SSRF vulnerability in the Oracle FLEXCUBE Private Banking product of Oracle Financial Services Applications component: Core Apache Axis. The supported versions which are...

Security Bulletin: Multiple Security Vulnerabilities in Apache Axis Affect IBM Sterling B2B Integrator (CVE-2014-3596, CVE-2012-5784)

Summary IBM Sterling B2B Integrator uses ActiveMQ. ActiveMQ uses Axis and is vulnerable. Vulnerability Details CVEID: CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the serve...

Oracle Primavera Unifier Multiple Vulnerabilities (Jan 2020 CPU)

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.16.0, or 17.7.x through 17.12.x prior to 17.12.11.2, or 18.8.x prior to 18.8.15, or 19.12.x prior to 19.12.0.1. It is, therefore, affected by...

Oracle Tuxedo Remote Code Execution Vulnerability (Jan 2020 CPU)

The version of Oracle Tuxedo installed on the remote host is missing a security patch. It is, therefore, affected by a remote code execution vulnerability due to a Server Side Request Forgery SSRF vulnerability found in the Apache Axis 1.4 distribution used in the TX SALT component. %NASLMINLEVEL...

Oracle Primavera Gateway Multiple Vulnerabilities (Jan 2020 CPU)

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.18, 16.x prior to 16.2.11, 17.x prior to 17.12.6, or 18.x prior to 18.8.8.1. It is, therefore, affected by multiple vulnerabilities, including the...

Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilties

Summary Multiple vulnerabilities in Cognos Analytics have been addressed. Vulnerabilities have been addressed in the following 3rd party software components that are consumed by IBM Cognos Analytics: Apache Xerces2, Apache Axis, and Apache POI. Other vulnerabilities have also been addressed...

The vulnerability of the Apache Axis web service platform, which exists due to the lack of measures taken to protect the structure of the web page, allows attackers to carry out XSS attacks.

The vulnerability of the Apache Axis web service platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

The vulnerability of the Apache Axis web service platform, related to insufficient validation of incoming requests, allows attackers to execute SSRF attacks.

The vulnerability of the Apache Axis web-service platform lies in the insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

Exploit for Server-Side Request Forgery in Apache Axis

cve-2019-0227 Apache Axis1.4 remote code execution vulnerabil...

Apache axis remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net

Recently, convinced that the server found the Apache axis component remote command execution exploit way. The vulnerability is essentially due to the administrator for the AdminService configuration error, when enableRemoteAdmin property is set to true, the attacker can remotely use of the...

GHSA-H9GJ-RQRW-X4FQ Server Side Request Forgery in Apache Axis

A Server Side Request Forgery SSRF vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2...

Server Side Request Forgery in Apache Axis

A Server Side Request Forgery SSRF vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2...

Server Side Request Forgery in Apache Axis

A Server Side Request Forgery SSRF vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2...