CVE-2017-3208

The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references XXEs from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server,...

CVE-2017-3207

The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an R...

Acunetix v12 - More Comprehensive, More Accurate and now 2X Faster

In-depth analysis of JavaScript-rich sites and Single Page Applications Acunetix, the pioneer in automated web application security software, has announced the release of version 12. This new version provides support for JavaScript ES7 to better analyse sites which rely heavily on JavaScript such...

IBM Liberty for Java for Bluemix XML External Entity Injection Vulnerability

IBM Liberty for Java for Bluemix is a set of dynamic application server runtime environments from IBM USA based on the IBM Bluemix Platform as a Service, PaaS product, which can be used to rapidly develop cloud applications. An XML external entity injection vulnerability exists in IBM Liberty for...

CVE-2017-1681

IBM WebSphere Application Server IBM Liberty for Java for Bluemix 3.15 could allow a local attacker to obtain sensitive information, caused by improper handling of application requests, which could allow unauthorized access to read a file. IBM X-Force ID: 134003...

CVE-2017-1583

IBM WebSphere Application Server IBM Liberty for Java for Bluemix 3.13could allow a remote attacker to obtain sensitive information caused by improper error handling by MyFaces in JSF...

libpam4j: Account check bypass

It was found that libpam4j did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information...

WebORB for Java Remote Code Execution Vulnerability

Midnight Coders WebORB for Java is a cross-platform Midnight Coders, Inc. integration server for desktop, browser and mobile clients and the corresponding Java POJO and other components and Web services to provide a common connection to data and media. A remote code execution vulnerability exists...

WebORB for Java XML External Entity Injection Vulnerability

Midnight Coders WebORB for Java is a cross-platform Midnight Coders, Inc. integration server for desktop, browser and mobile clients and the corresponding Java POJO and other components and Web services to provide a common connection to the data and media. An XML external entity injection...

CVE-2016-8741

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for...

PT-2017-9775 · Apache · Apache Qpid Broker For Java

Name of the Vulnerable Software and Affected Versions: Apache Qpid Broker for Java versions 6.0.x through 6.0.5 Apache Qpid Broker for Java versions 6.1.x through 6.1.0 Description: The Apache Qpid Broker for Java can be configured to use different AuthenticationProviders to handle user...

Java AMF3 deserialization vulnerability analysis-vulnerability warning-the black bar safety net

AMF Action Message Format is a binary serialization format, before the main Flash application in using this format. Recently, the Code White found to have multiple Java AMF library in the presence of vulnerabilities, and these vulnerabilities will lead to unauthenticated remote code execution...

AMF3 Java implementations deserialization Vulnerability

Details reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers derive class instances from java. io. Externalizable rather than the AMF3 specification's recommendation of a flash. utils. IExternalizable. A remote attacker with the ability to...

CVE-2016-8281

Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-553...

CVE-2016-0323

The Auto-Scaling agent in Liberty for Java in IBM Bluemix before 2.7-20160321-1358 allows remote authenticated users to disable X.509 certificate validation, and consequently bypass an intended HTTPS trust-management feature, via unspecified vectors...

CVE-2016-0323

The CVE-2016-0323 issue affects Liberty for Java running in IBM Bluemix when bound to the Auto-Scaling for Bluemix service, specifically versions prior to 2.7-20160321-1358. The Auto-Scaling agent can disable SSL certificate validation, bypassing the HTTPS trust-management feature. The IBM Bluemi...

IBM Bluemix Liberty for Java Security Bypass Vulnerability

IBM Bluemix Liberty for Java is a set of dynamic application server runtime environments based on IBM Bluemix Platform as a Service, PaaS products from IBM in the United States. A security bypass vulnerability exists in Liberty for Java in versions prior to IBM Bluemix 2.7-20160321-1358, which ca...

Oracle Java SE CVE-2015-2590 Remote Security Vulnerability

Description Oracle Java SE is prone to a remote security vulnerability. The vulnerability can be exploited over multiple protocols. This issue affects the 'Libraries' sub-component. This vulnerability affects the following supported versions: Java SE 6u95, Java SE 7u80, Java SE 8u45, Java SE...

Vulnerability in RC4 stream cipher affects AIX,Vulnerability in RC4 stream cipher affects ftpd/sendmail_ssl/imapd/popd on AIX,Vulnerability in RC4 stream cipher affects ftpd/sendmail_ssl/imapd/popd on VIOS

IBM SECURITY ADVISORY First Issued: Mon Apr 27 15:27:04 CDT 2015 | Updated: Tue Dec 15 11:54:19 CST 2015 | Update: Added all information for ftpd, sendmailssl, imapd, and popd The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/rc4advisory.a...

Important: Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update

Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P6 Patch 6 on Rollup Patch 1, which addresses three security issues, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...