CVE-2021-27601: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver AS Java Applications based on HTMLB for Java allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting XSS vulnerability and the attacker can read and modify data. However, the attack...

CVE-2021-21485: Undefined Security Weakness

An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user...

Security Update for Microsoft Visual Studio Code Maven for Java Extension (April 2021)

The Microsoft Visual Studio Code Maven for Java Extension is prior to version 0.29.0. It is, therefore, affected by a remote code execution vulnerability. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2020 - Includes Oracle Oct 2020 CPU minus CVE-2020-14781 and CVE-2020-14782 affects Liberty for Java for IBM Cloud

Summary Multiple vulnerabilities in IBM® Java SDK affect Liberty for Java October 2020 CPU. Vulnerability Details CVEID: CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service...

CVE-2020-16971

Azure SDK for Java Security Feature Bypass Vulnerability...

CVE-2020-16971: Undefined Security Weakness

Azure SDK for Java Security Feature Bypass Vulnerability...

CVE-2020-6285

SAP NetWeaver - XML Toolkit for JAVA ENGINEAPI versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, under certain conditions allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure...

PT-2020-19076

Name of the Vulnerable Software and Affected Versions SAP NetWeaver - XML Toolkit for JAVA ENGINEAPI versions 7.10 through 7.50 Description The issue allows an attacker to access information that would otherwise be restricted, leading to information disclosure. This occurs under certain condition...

CVE-2020-6285: Undefined Security Weakness

SAP NetWeaver - XML Toolkit for JAVA ENGINEAPI versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, under certain conditions allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure...

Security Bulletin: Information disclosure vulnerability in Liberty for Java for IBM Cloud (CVE-2019-4441)

Summary There is a potential information disclosure vulnerability in IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2019-4441 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive information when a stack trace is returned in the...

Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Cloud (CVE-2019-4304, CVE-2019-4305)

Summary There is an information disclosure and a bypass security vulnerability in WebSphere Application Server Liberty. These vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION: IBM WebSphere Application Server - Liberty could allow a remote attacker to...

CVE-2019-2907

Vulnerability in the Oracle Web Services product of Oracle Fusion Middleware component: SOAP with Attachments API for Java. The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web...

CVE-2019-2907: Undefined Security Weakness

Vulnerability in the Oracle Web Services product of Oracle Fusion Middleware component: SOAP with Attachments API for Java. The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web...

PT-2019-3745

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.3.0 Description The issue is related to inadequate access control in the SOAP with Attachments API for Java component of Oracle WebLogic Server, part of the Oracle Fusion Middleware platform. This can be...

Oracle Web Services CVE-2019-2907 Remote Security Vulnerability

Description Oracle Web Services is prone to a remote security vulnerability. The vulnerability can be exploited over the 'HTTP' protocol. The 'SOAP with Attachments API for Java' component is affected. This vulnerability affects the following supported versions: 12.2.1.3.0 Technologies Affected...

CVE-2019-0365: Undefined Security Weakness

SAP Kernel RFC, KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows BC-FES-GUI before versions 7.5, 7.6, and SAP GUI for Java...

CVE-2019-12400

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this...

PT-2019-4439

Name of the Vulnerable Software and Affected Versions Apache Santuario XML Security for Java versions 2.0.3 through 2.1.3 Description The issue is related to a caching mechanism introduced in version 2.0.3 of Apache Santuario XML Security for Java, which can lead to potential security flaws when...

CVE-2019-12400: Improper Input Validation

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this...

CVE-2019-0345: Server-Side Request Forgery (SSRF)

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...