cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service DoS attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack...

CVE-2018-8302

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka “Microsoft Exchange Memory Corruption Vulnerability.” This affects Microsoft Exchange Server. Recent assessments: zeroSteiner at March 20, 2020 1:04pm UTC...

Microsoft Edge Spoofing Vulnerability

A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website. The specially crafted website could either spoof content or serve as a piv...

Microsoft Edge Spoofing Vulnerability

A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content. An attacker who successfully exploited this vulnerability could trick a user into believing that the user was on a legitimate website. The specially crafted website could either spoof content or serve as...

Cloudtoken Information Disclosure Vulnerability

Cloudtoken is a command line utility used in Unix environments to provide authentication capabilities. An information disclosure vulnerability exists in Cloudtoken versions 0.1.1 excluding version 0.1.1 through 0.1.24 excluding version 0.1.24, which can be exploited by an attacker to obtain...

PYSEC-2018-1

Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles...

CVE-2018-13390

Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles...

Qualys Cloud Platform 2.34 New Features

This release of the Qualys Cloud Platform version 2.34 includes updates and new features for Cloud Agent, EC2 Connector, Continuous Monitoring, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall, highlights as follows. Cloud Agent Automatic Merge of Cloud...

The vulnerability of the WLS-Web Services component of the WebLogic Server application server allows a attacker to gain full control over the application.

The vulnerability of the WLS-Web Services component of the WebLogic Server application server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application using the HTTP protocol...

USN-3718-1: Linux kernel regression

USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. Unfortunately, the fix for CVE-2018-1108 introduced a regression where insufficient early entropy prevented services from starting, leading in some situations to a failure to boot, This update addresses the issue. We...

Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Spring Framework Sample Apps subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. CVE-2018-1275 - ...

CVE-2018-2894

CVE-2018-2894 affects Oracle WebLogic Server (WLS - Web Services) in Oracle Fusion Middleware; vulnerable versions include 12.1.3.0, 12.2.1.2 and 12.2.1.3. The flaw enables unauthenticated, network-based attackers to execute code on the server via HTTP, potentially taking over the WebLogic Server...

CVE-2018-2894

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services. Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

Lenovo Smart Assistant Android app privilege acquisition vulnerability

Lenovo Smart Assistant Android app is an Android-based application for controlling Lenovo Smart Assistant smart speakers from Lenovo China. A security vulnerability exists in the Lenovo Smart Assistant Android app versions prior to 12.1.82. An attacker can use this vulnerability to enter factory...

CloudBees Jenkins AWS CodeBuild Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks.AWS CodeBuild Plugin is used in one of the test projec...

CloudBees Jenkins AWS CodeDeploy Plugin Information Disclosure Vulnerability

CloudBees Jenkins is a set of Java-based continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . AWS CodeDeploy Plugin is used in one of the deployment components . An information...

NetApp SANtricity Web Services Proxy Detection

Binary data netappsantricitywebserviceproxydetect.nbin...

Dialogic PowerMedia XMS XML External Entity Injection Vulnerability

Dialogic PowerMedia XMS is a highly scalable, software-only media server that supports standards-based, real-time multimedia communication solutions for mobile and broadband environments. An XML external entity injection vulnerability exists in the Web services in Dialogic PowerMedia XMS 3.5 and...

Dialogic PowerMedia XMS Hardcoded Credentials Vulnerability

Dialogic PowerMedia XMS is a suite of software multimedia servers for real-time communications from Dialogic, Inc. that provide real-time multimedia communication solutions for IMS, MRF, enterprise and WebRTC applications. A hard-coded credentials vulnerability in the...

USN-3695-1: Linux kernel vulnerabilities

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly initialize the crc32c checksum driver. A local attacker could use this to cause a denial of service system crash. CVE-2018-1094 It was discovered that the cdrom driver in the Linux kernel contained an...