CVE-2016-0456

Affected software: Oracle E-Business Suite 12.1/12.2 with Application Mgmt Pack for E-Business Suite REST component. Vulnerability: unspecified issue in REST Framework that could affect confidentiality. Potential root-cause mentions an XXE claim; Oracle has not commented on third-party XXE claims...

CVE-2016-0456

Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0457. NOTE: the previous information is...

CVE-2016-0457

Technical details about CVE-2016-0457 (affected product/component/impact/remediation) are not provided in the supplied documents; monitor for updates.

Samsung KNOX 1.0 Weak eCryptFS Key Generation

Subject: CVE-2016-1919 Weak eCryptFS Key generation from user password on KNOX 1.0 / Android 4.3 Vulnerability Description ========================= The vulnerability allows disclosure of Data-at-Rest of Samsung KNOX 1.0 containers. KNOX container data is encrypted using eCryptFS containers. The...

[SECURITY] Fedora 23 Update: openstack-glance-2015.1.2-1.fc23

OpenStack Image Service code-named Glance provides discovery, registratio n, and delivery services for virtual disk images. The Image Service API server provides a standard REST interface for querying information about virtual d isk images stored in a variety of back-end stores, including OpenSta...

Hackazon - A Modern Vulnerable Web App

Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective training and...

Ganeti RESTful Control Interface Information Disclosure Vulnerability

Ganeti is a suite of virtual machine management software based on Xen Virtual Machine Manager and other open source software. The software supports Xen virtualization technology, disk management and more. An information disclosure vulnerability exists in Ganeti. A remote attacker could exploit th...

IBM WebSphere Portal AccessControl REST API Information Disclosure (PI51395)

The version of IBM WebSphere Portal installed on the remote Windows host is affected by an information disclosure vulnerability due to improper access control enforcement of the REST API. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to gain access to...

Atlassian Confluence 5.2 / 5.8.14 / 5.8.15 - Multiple Vulnerabilities

Exploit for php platform in category web applications Systems Affected Product : Confluence Company : Atlassian Versions 1 : 5.2 / 5.8.14 / 5.8.15 CVSS Score 1 : 6.1 / Medium classified by vendor Versions 2 : 5.9.1 / 5.8.14 / 5.8.15 CVSS Score 2 : 7.7 / High classified by vendor Product Descripti...

Atlassian Confluence 5.25.8.145.8.15 - Multiple Vulnerabilities

Atlassian Confluence 5.25.8.145.8.15 - Multiple Vulnerabilities Systems Affected Product : Confluence Company : Atlassian Versions 1 : 5.2 / 5.8.14 / 5.8.15 CVSS Score 1 : 6.1 / Medium classified by vendor Versions 2 : 5.9.1 / 5.8.14 / 5.8.15 CVSS Score 2 : 7.7 / High classified by vendor Product...

Atlassian Confluence 5.2/5.8.14/5.8.15 - Multiple Vulnerabilities

Systems Affected Product : Confluence Company : Atlassian Versions 1 : 5.2 / 5.8.14 / 5.8.15 CVSS Score 1 : 6.1 / Medium classified by vendor Versions 2 : 5.9.1 / 5.8.14 / 5.8.15 CVSS Score 2 : 7.7 / High classified by vendor Product Description Confluence is team collaboration software, where yo...

Ubiquiti Inc.: Reflected File Download in community.ubnt.com/restapi/

Hello, https://community.ubnt.com/restapi/vc/authentication/sessions/Ubiquitiupdate.cmd?restapi.responseformat=json&callback=%22||calc|| The above URL is vulnerable to RFD. Here is the proof of concept: Browser Chrome: Embedded the above URL in html 5 anchor tags with download attribute: Download...

CVE-2015-7452

IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API...

Code injection

IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API...

CVE-2015-7452

IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API...

CVE-2015-7452

IBM Maximo Asset Management (versions 7.6 and 7.5, including related Maximo variants and SmartCloud Control Desk) has a vulnerability that could allow remote authenticated users to obtain sensitive information via the REST API. The issue is documented with CVSS v3 base score 4.3 (LOW). Affected p...

Design/Logic Flaw

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF09 allows remote attackers to bypass intended Portal AccessControl REST API access restrictions and obtain sensitive information via unspecified...

Scientific Linux Security Update : rest on SL7.x x86_64 (20151119)

It was found that the OAuth implementation in librest, a helper library for RESTful services, incorrectly truncated the pointer returned by the restproxycallgeturl call. An attacker could use this flaw to crash an application using the librest library. CVE-2015-2675 After installing the update, a...

Secure Data Space 3.1.1-2 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 secunet Security Networks AG Security Advisory Advisory: SECURE DATA SPACE API Multiple Non-Persistent Cross-Site Scripting Vulnerabilities 1. DETAILS - ---------- Product: SECURE DATA SPACE Vendor URL: www.ssp-europe.eu Type: Cross-site...

A Quick Glance at Modern Browsers's Protection Part #1

tl;dr in this blog post we are going to give a look at modern browsers's protection with some hands on example available at and deployed in Heroku. This blog post is NOT about Same-origin policy Introduction In this blog post we are going to give a look at modern browsers's protection. More...