318 matches found
SAP BusinessObjects Axis2 Default Admin Password
Overview The Axis2 component of SAP BusinessObjects contains a default administrator account and password. Description The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone...
Apache Axis2 Detection (HTTP)
HTTP based detection of Apache Axis2, a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Apache Axis2 < 1.5.2 Document Type Declaration Processing Security Vulnerability
Apache Axis2 is prone to a security vulnerability that may result in information disclosure or denial-of-service DoS conditions. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Apache Axis2 1.x - axis2axis2-admin Session Fixation
Apache Axis2 1.x - axis2axis2-admin Session Fixation source: https://www.securityfocus.com/bid/41076/info Apache Axis2 is prone to a session-fixation vulnerability. Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application. Apache Axis2 1...
Apache Axis2文档类型声明处理多个安全漏洞
BUGTRAQ ID: 40976 CVE ID: CVE-2010-1632 Axis2是一个Web服务的核心支援引擎。 根据SOAP 1.1规范的规定，SOAP消息总不能包含有文档类型声明（DTD）。在Axis2中，是通过StAXSOAPModelBuilder类来实现这个限制的。这个方法存在两个问题： 1 仅适用于SOAP绑定，而支持纯XML消息的HTTP绑定仍允许请求消息中存在DTD。 2 在处理带有DTD的文档时，StAXSOAPModelBuilder仅在从StAX解析器接收到DTD事件后才会报告错误，而这时StAX解析器可能已经处理或部分处理了DTD。...
Apache Axis2 1.x - '/axis2/axis2-admin' Session Fixation
source: https://www.securityfocus.com/bid/41076/info Apache Axis2 is prone to a session-fixation vulnerability. Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application. Apache Axis2 1.5 is vulnerable; other versions may also be affected...
CVE-2010-1632
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...
Design/Logic Flaw
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...
CVE-2010-1632
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...
DSquare Exploit Pack: D2SEC_AXIS
Name| d2secaxis ---|--- CVE| CVE-2010-1632 Exploit Pack| D2ExploitPack Description| Apache Axis2 Remote File Access Notes|...
CVE-2010-1632
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...
CVE-2010-1632
CVE-2010-1632 affects Apache Axis2 (Java) and is triggered by improper rejection of DTDs in SOAP messages. The issue allows a remote attacker to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via a crafted DTD, demonstrated by an entity declaration in a...
CVE-2010-1632: Improper Input Validation
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...
Apache Axis2 v1.4.1 Local File Inclusion
This module exploits an Apache Axis2 v1.4.1 local file inclusion LFI vulnerability. By loading a local XML file which contains a cleartext username and password, attackers can trivially recover authentication credentials to Axis services. This module requires Metasploit:...
PR10-02: Various XSS and information disclosure flaws within 3Com* iMC (Intelligent Management Center)
PR10-02: Various XSS and information disclosure flaws within 3Com iMC Intelligent Management Center On the 12th April 2010 Hewlett Packard completed its acquisition of 3Com Vulnerability found: 29th January 2010 Vendor informed: 1st February 2010 Vulnerability fixed: 13th May 2010 Severity:...
CVE-2010-2103
Cross-site scripting XSS vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary w...
Cross site scripting
Cross-site scripting XSS vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary w...
CVE-2010-2103
Cross-site scripting XSS vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary w...
CVE-2010-2103
Cross-site scripting XSS vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary w...
CVE-2010-2103
CVE-2010-2103: Apache Axis2/Java Axis2 administration console (axis2-admin/engagingglobally) is vulnerable to cross-site scripting via the modules parameter. Affected: Axis2/Java 1.4.1, 1.5.1 (and possibly other versions) used in SAP Business Objects 12, 3Com IMC, etc. The vulnerability is due to...