CVE-2017-7686

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

Information disclosure

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

PYSEC-2017-146

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

PYSEC-2017-146

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

CVE-2017-7686

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

CVE-2017-7686

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

CVE-2017-7686

Apache Ignite versions 1.0.0-RC3 through 2.0 are affected by an information disclosure vulnerability stemming from an update notifier that communicates to an external PHP server (ignite.run) and transmits system properties (e.g., Ignite/Java version) that may contain user‑sensitive information. I...

Information Disclosure

Apache Ignite is vulnerable to information disclosure. The library contains an update notifier component to notify users about new project releases. This component sends sensitive information to an external PHP server http://ignite.run that a malicious user can observe to obtain sensitive data...

Apache Ignite Information Disclosure and XML External Entity Injection Vulnerabilities

Ignite is the in-memory computing platform. Apache Ignite suffers from an information disclosure and XML external entity injection vulnerability, which can be exploited by an attacker to modify the update-notifier document and read arbitrary files via an XXE attack...

CVE-2016-6805

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

Code injection

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

CVE-2016-6805

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

CVE-2016-6805

Summary : CVE-2016-6805 affects Apache Ignite before 1.9. The issue arises from an XML External Entity (XXE) vulnerability in the update-notifier documents, allowing a man-in-the-middle to read arbitrary files. The description in connected sources consistently cites the XXE flaw as the root cause...

CVE-2016-6805

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

Ignite Realtime Smack Man-in-the-Middle Security Bypass Vulnerability

Ignite Realtime Smack is the open source XMPP client library for instant messaging and presentation. A security bypass vulnerability exists in Exponent Ignite Realtime Smack versions prior to version 4.1.9. Successful exploitation of this vulnerability may allow an attacker to perform unauthorize...

Microsoft Unveils Cloud-Based Fuzz-Testing Service

Microsoft announced a cloud-based fuzz testing service called Project Springfield that identifies software bugs in applications that could turn into vulnerabilities. The service, announced at this week’s Microsoft 2016 Ignite technology conference in Atlanta, combines artificial intelligence and...

OpenFire 4.0.1 Cross Site Request Forgery / Cross Site Scripting

Several vulnerabilities doscovered in OpenFire version 3.10.2 to 4.0.1 Product Description OpenFire is an opensource project under GNU GPL licence. It provides a Jabber/XMPP server fully develloped in Java. It's develloped by the Ignite realtime community. The actual version of the product is...

OpenFire 3.10.2 < 4.0.1 - Multiple Vulnerabilities

Several vulnerabilities doscovered in OpenFire version 3.10.2 to 4.0.1 Product Description OpenFire is an opensource project under GNU GPL licence. It provides a Jabber/XMPP server fully develloped in Java. It's develloped by the Ignite realtime community. The actual version of the product is...

OpenFire 3.10.2 < 4.0.1 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Several vulnerabilities doscovered in OpenFire version 3.10.2 to 4.0.1 Product Description OpenFire is an opensource project under GNU GPL licence. It provides a Jabber/XMPP server fully develloped in Java. It's develloped by the Ignite realti...

Resources Downloaded over Insecure Protocol

Overview Affected versions of igniteui download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection. Recommendation The igniteui package h...