CVE-2014-8152: Undefined Security Weakness

Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document...

PT-2015-4015

Name of the Vulnerable Software and Affected Versions Apache Santuario XML Security for Java versions 2.0.x through 2.0.2 Description The issue allows remote attackers to bypass the streaming XML signature protection mechanism. This can be achieved by sending a crafted XML document. Recommendatio...

PT-2014-6140

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ classes for Java libraries versions 8.0 before 8.0.0.1 IBM Websphere MQ Explorer versions 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 Description The issue allows local users to discover preconfigured cleartext passwords via an...

CVE-2014-4822: Undefined Security Weakness

IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allow local users to discover preconfigured cleartext passwords via an unspecified trace operation...

Important: Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update

Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P6 Patch 6 on Rollup Patch 1, which addresses three security issues, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

Java: XML signature spoofing

A flaw was found in the way Apache Santuario XML Security for Java validated XML signatures. Santuario allowed a signature to specify an arbitrary canonicalization algorithm, which would be applied to the SignedInfo XML fragment. A remote attacker could exploit this to spoof an XML signature via ...

IBM WebSphere Application Server 7.0 < Fix Pack 31 Multiple Vulnerabilities

IBM WebSphere Application Server 7.0 before Fix Pack 31 appears to be running on the remote host. It is, therefore, potentially affected by the following vulnerabilities : - A flaw in the modrewrite module of Apache HTTP Server potentially allows a remote attacker to execute arbitrary code via...

CVE-2013-4517

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service memory consumption via crafted Document Type Definitions DTDs, related to signatures...

CVE-2013-4517: Undefined Security Weakness

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service memory consumption via crafted Document Type Definitions DTDs, related to signatures...

[APKinspector] Powerful GUI tool to analyze the Android applications

The goal of this project is to aide analysts and reverse engineers to visualize compiled Android packages and their corresponding DEX code. APKInspector provides both analysis functions and graphic features for the users to gain deep insight into the malicious apps: CFG Call Graph Static...

CVE-2013-5679

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API ESAPI for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protectio...

CVE-2013-5960

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API ESAPI for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic...

CVE-2013-5960: Undefined Security Weakness

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API ESAPI for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic...

PT-2013-5884

Name of the Vulnerable Software and Affected Versions OWASP Enterprise Security API ESAPI for Java versions prior to 2.1.0.1 Description The authenticated-encryption feature in the symmetric-encryption implementation does not properly resist tampering with serialized ciphertext. This makes it...

PT-2013-5723

Name of the Vulnerable Software and Affected Versions OWASP Enterprise Security API ESAPI for Java versions prior to 2.1.0 Description The issue concerns the authenticated-encryption feature in the symmetric-encryption implementation, which does not properly resist tampering with serialized...

DEBIAN-CVE-2013-2172

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization...

CVE-2013-2172: Undefined Security Weakness

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization...

PT-2012-5948

Name of the Vulnerable Software and Affected Versions Eduserv OpenAthens SP version 2.0 for Java Description The issue allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, also known as a "Signature exclusion attack"...

extension): MITM due to improper validation of AX attribute signatures

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

extension): MITM due to improper validation of AX attribute signatures

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...