CVE-2017-3761

The CVE-2017-3761 entry concerns the Lenovo Service Framework (LSF) Android application, where the component executes system commands with insufficient input sanitization, enabling command injection and remote code execution. Affected scope includes Lenovo Android tablets and certain VIBE/ZUK/Mot...

CVE-2017-3761

The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead to command injection which, in turn, could lead to remote code execution...

CVE-2017-3758

CVE-2017-3758 affects Lenovo Service Framework (LSF) Android components. The vulnerability stems from improper access controls in Android components within LSF, allowing remote code execution. Public sources detail that LSF is an Android framework used to receive push notifications on Lenovo devi...

CVE-2017-3760

The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded applications and/or data. This exposes the application to man-in-the-middle attacks leading to possible remote code execution...

CVE-2017-3759

The CVE-2017-3759 issue affects the Lenovo Service Framework (LSF) Android application used on Lenovo tablets and select phones. The root cause is that LSF accepts some server responses without proper validation, exposing the app to man-in-the-middle attacks and potential remote code execution. P...

RESTEasy XML External Entity Injection Vulnerability

RESTEasy is the United States Red Hat Red Hat, Inc. of a JBoss open source project , which provides a variety of frameworks for building RESTful Web Services and RESTful Java applications . RESTEasy has an XML external entity injection vulnerability. An attacker could exploit this vulnerability t...

Unspecified Vulnerability in Oracle Retail Applications Open Commerce Platform Cloud Service Framework Component

Oracle Retail Applications is a suite of retail applications store solutions, of which the Oracle Retail Open Commerce Platform is an e-business solution component. An unspecified vulnerability exists in the Oracle Retail Applications Open Commerce Platform Cloud Service Framework component, whic...

CVE-2016-0456

Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0457. NOTE: the previous information is...

CXF: Large invalid content could cause temporary space to fill

It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of dis...

CXF: HTML content posted to SOAP endpoint could cause OOM errors

A denial of service flaw was found in the way Apache CXF created error messages for certain POST requests. A remote attacker could send a specially crafted request which, when processed by an application using Apache CXF, could consume an excessive amount of memory on the system, possibly...

Important: Red Hat Security Advisory: jbossws-common security update

An updated jbossws-common.jar file for JBoss Enterprise Portal Platform 5.1.1 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...