Security Bulletin: Two vulnerabilities exist in IBM Case Foundation and FileNet Business Process Manager (CVE-2012-5784 and CVE-2014-3596)

Summary Apache Axis contains two security vulnerabilities that could allow for spoofing attacks. See the individual descriptions below for the details. Vulnerability Details CVE-ID: CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products, could allow a remote attacker to conduct...

Security Bulletin: Security Vulnerability in Apache Axis affects IBM WebSphere Dashboard Framework (CVE-2014-3596)

Summary There is an insecure certificate validation CVE-2014-3596 in Apache Axis which is bundled with IBM WebSphere Dashboard Framework. Vulnerability Details IBM WebSphere Dashboard Framework WDF bundles a copy of Apache Axis which can be used to make web service requests. A vulnerability in Ax...

Security Bulletin: A vulnerability in Apache Axis affects IBM Cognos Metrics Manager (CVE-2012-5784)

Summary An Apache Axis vulnerability was disclosed in Nov 2012. The Apache Axis library is included with IBM Cognos Metrics Manager. IBM Cognos Metrics Manager has addressed the vulnerability. Vulnerability Details CVEID: CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products,...

Security Bulletin: IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities (CVE-2014-3566, CVE-2014-6145, CVE-2014-1568, CVE-2014-4263, CVE-2012-5784, CVE-2014-3513, CVE-2014-3567 and CVE-2014-3568).

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition that is used by IBM Cognos Business Intelligence. These issues were disclosed as part of the IBM Java SDK updates in July 2014. OpenSSL vulnerabilities along with SSL 3 Fallback protection...

Oracle Human Resources Management System PeopleSoft unauthorized remote code execution vulnerability parsing-vulnerability warning-the black bar safety net

! A few months ago, I had the privilege of participating in several of Oracle's PeopleSoft construction project Safety Audit, the audit object mainly for the PeopleSoft series of Human Resources Management System, HRMS, and development tools package PeopleTool it. Throughout the online on the...

Oracle PeopleSoft Remote Code Execution: Blind XXE to SYSTEM Shell

Oracle PeopleSoft I had the chance, a few months ago, to audit several Oracle PeopleSoft solutions, including PeopleSoft HRMS and PeopleTool. Despite several undocumented CVEs, the Internet did not have much to offer on how to attack the software, except for the very informative talk from ERPScan...

F5 Networks BIG-IP : Apache Axis vulnerability (SOL16821)

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subjec...

Apache Axis Detection (HTTP)

HTTP based detection of the Apache Axis SOAP stack. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH SPDX-FileCopyrightText: Reworked detection methods / pattern / code since 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2015-7913

agserverservice.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows local users to execute arbitrary Java code with SYSTEM privileges by using the Apache Axis AdminService deployment method to publish a class...

Design/Logic Flaw

agserverservice.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows local users to execute arbitrary Java code with SYSTEM privileges by using the Apache Axis AdminService deployment method to publish a class...

CVE-2015-7913

agserverservice.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows local users to execute arbitrary Java code with SYSTEM privileges by using the Apache Axis AdminService deployment method to publish a class...

CVE-2015-7913

CVE-2015-7913 affects Tibbo AggreGate Platform (ag_server_service.exe) prior to version 5.30.06. A local attacker can publish arbitrary Java classes via the Apache Axis AdminService deployment method, enabling code execution with SYSTEM privileges. Mitigation: update to AggreGate Platform 5.30.06...

CVE-2015-7913: Undefined Security Weakness

agserverservice.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows local users to execute arbitrary Java code with SYSTEM privileges by using the Apache Axis AdminService deployment method to publish a class...

Tibbo AggreGate SCADA/HMI Apache Axis AdminService Arbitrary Class Instantiation Privilege Escalation Vulnerability

This vulnerability allows attackers to elevate privileges on vulnerable installations of Tibbo AggreGate SCADA/HMI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Windows servi...

CVE-2015-7818

The administration-panel web service in IBM System Networking Switch Center SNSC before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file...

Code injection

The administration-panel web service in IBM System Networking Switch Center SNSC before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file...

CVE-2015-7818

CVE-2015-7818 affects IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0. The issue enables a local attacker to upload and execute a JSP file under SYSTEM privileges by exploiting the Apache Axis AdminService deployment method. Affected version detai...

CVE-2015-7818

The administration-panel web service in IBM System Networking Switch Center SNSC before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file...

Lenovo Switch Center Local Lift Vulnerability

Lenovo Switch Center formerly known as IBM System Networking Switch Center is a suite of applications used by Lenovo in China to remotely monitor and manage Ethernet converged switches. A local lift vulnerability exists in IBM System Networking Switch Center versions 7.1.3.4 and earlier and Lenov...

CVE-2015-7818: Undefined Security Weakness

The administration-panel web service in IBM System Networking Switch Center SNSC before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file...