CVE-2010-1632

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...

Openwsman HTTP Basic Authentication Buffer Overflow (CVE-2008-2234)

Openwsman is an implementation of Web Services Management WS-Management specification. It uses the WS-Management protocol, which is a SOAP-based protocol using HTTP for exchange of information related to management of devices and applications in a platform independent manner. There exists a stack...

Apache Axis2 Administration Console - (Authenticated) Cross-Site Scripting

PR10-03 Authenticated Cross-Site Scripting Vulnerability XSS within Apache Axis2 administration console Source: http://www.procheckup.com/vulnerabilitymanager/vulnerabilities/pr10-03 Advisory publicly released: Friday, 21 May 2010 Vulnerability found: Saturday, 30 January 2010 Severity level:...

SOAP and XML-RPC APIs return too much information

The SOAP and XML-RPC APIs return more information than is needed. This issue corrects that problem. This issue is rated HIGH. Please see http://confluence.atlassian.com/x/ZILmD for more security related issues and information on how we rate our issues...

SOAP and XML-RPC APIs return too much information

The SOAP and XML-RPC APIs return more information than is needed. This issue corrects that problem. This issue is rated HIGH. Please see http://confluence.atlassian.com/x/ZILmD for more security related issues and information on how we rate our issues...

Require user to answer CAPTCHA after three failed attempts

Require user to answer CAPTCHA after three failed attempts. For SOAP and XMLRPC this means that the user will have to open a browser to answer the CAPTCHA, similar to how google does it. This issue has been rated MODERATE. Please refer to http://confluence.atlassian.com/x/ZILmD for details on oth...

Computer Associates XOsoft SOAP Request Username Enumeration (CA20100406)

The remote web server is a component of XOsoft, a product from Computer Associates for combined business continuity and disaster recovery. The installed version of this service does not require authentication when handling SOAP requests to enumerate user names. An unauthenticated, remote attacker...

Design/Logic Flaw

CA XOsoft r12.0 and r12.5 does not properly perform authentication, which allows remote attackers to enumerate usernames via a SOAP request...

CVE-2010-1223

Multiple buffer overflows in CA XOsoft r12.0 and r12.5 allow remote attackers to execute arbitrary code via 1 a malformed request to the wsman/xosoapapi.asmx SOAP endpoint or 2 a long string to the entrypoint.aspx service...

CVE-2010-1222

CA XOsoft r12.5 does not properly perform authentication, which allows remote attackers to obtain potentially sensitive information via a SOAP request...

Buffer overflow

Multiple buffer overflows in CA XOsoft r12.0 and r12.5 allow remote attackers to execute arbitrary code via 1 a malformed request to the wsman/xosoapapi.asmx SOAP endpoint or 2 a long string to the entrypoint.aspx service...

Design/Logic Flaw

CA XOsoft r12.5 does not properly perform authentication, which allows remote attackers to obtain potentially sensitive information via a SOAP request...

CVE-2010-1221

CA XOsoft r12.0 and r12.5 does not properly perform authentication, which allows remote attackers to enumerate usernames via a SOAP request...

CVE-2010-1221

CA XOsoft r12.0 and r12.5 does not properly perform authentication, which allows remote attackers to enumerate usernames via a SOAP request...

CVE-2010-1223

Multiple buffer overflows in CA XOsoft r12.0 and r12.5 allow remote attackers to execute arbitrary code via 1 a malformed request to the wsman/xosoapapi.asmx SOAP endpoint or 2 a long string to the entrypoint.aspx service...

CVE-2010-1222

CA XOsoft r12.5 does not properly perform authentication, which allows remote attackers to obtain potentially sensitive information via a SOAP request...

CVE-2010-1222

CVE-2010-1222 affects CA XOsoft r12.5. The root cause is a lack of authentication, allowing unauthenticated SOAP requests to obtain potentially sensitive information (information disclosure). References indicate the issue affects XOsoft 12.5 products and CA issued patches (RO15016) for r12.5 prod...

CVE-2010-1221: Improper Authentication

CA XOsoft r12.0 and r12.5 does not properly perform authentication, which allows remote attackers to enumerate usernames via a SOAP request...

ZDI-10-065: CA XOsoft xosoapapi.asmx Multiple Remote Code Execution Vulnerabilities

ZDI-10-065: CA XOsoft xosoapapi.asmx Multiple Remote Code Execution Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-10-065 April 6, 2010 -- CVE ID: CVE-2010-1223 -- Affected Vendors: Computer Associates -- Affected Products: Computer Associates XOsoft High Availability Computer...

CVE-2010-1222: Improper Authentication

CA XOsoft r12.5 does not properly perform authentication, which allows remote attackers to obtain potentially sensitive information via a SOAP request...