Apache CXF Authentication Bypass Vulnerability

Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. A security vulnerability exists in Apache CXF versions prior to 3.2.5 and 3.1.16, which...

OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997)

Vulnerability in the Java SE, JRockit component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java...

Cisco ASA Web Services DoS (cisco-sa-20180606-asaftd)

According to its self-reported version the Cisco Adaptive Security Appliance ASA software running on the remote device is affected by multiple vulnerabilities. Please see the included Cisco BIDs and Cisco Security Advisories for more information. C Tenable Network Security, Inc...

NetApp SANtricity Web Services Proxy and SANtricity Storage Manager Command Execution Vulnerability

NetApp SANtricity Web Services Proxy and SANtricity Storage Manager are both products of the U.S.-based NetApp Corporation.NetApp SANtricity Web Services Proxy is a suite of disk array management software. The software provides a Web API to configure, manage, and monitor E-Series and EF-Series di...

Security Bulletin: IBM TRIRIGA Application Unintended Proxy or Intermediary (CVE-2016-0362)

Summary IBM TRIRIGA platform allows remote attackers to use one of its web services as a proxy to forward HTTP requests to other internal/external Web resources. Vulnerability Details CVEID: CVE-2016-0362 CVSS Base Score: 4.3 CVSS Temporal Score: See for the current score CVSS Environmental Score...

Security Bulletin: OpenSAML XML information disclosure (CVE-2013-6440)

Summary A version of OpenSAML shipped with Cúram could allow a remote authenticated attacker to obtain sensitive information. Customers that use opensaml.jar to secure web services may be affected. Vulnerability Details CVEID: CVE-2013-6440 DESCRIPTION: OpenSAML could allow a remote authenticated...

Security Bulletin: FileNet CMIS (FNCMIS) and Content Manager 8 CMIS (CM CMIS) does not verify the incoming Web Services request's message size

Summary Automatically sending number of very large size Web Services SOAP messages can cause DOS attacks. Vulnerability Details CVEID: Not Applicable DESCRIPTION: After an Apache OpenCMIS Client often custom code is successfully authenticated with the repository FN CMIS & CM CMIS and automaticall...

Security Bulletin: Financial Transaction Manager for ACH Services has a potential input validation vulnerability (CVE-2018-1392)

Summary Financial Transaction Manager FTM for ACH Services has addressed a potential input validation vulnerability for some web services in the web services component. Vulnerability Details CVEID: CVE-2018-1392 DESCRIPTION: IBM Financial Transaction Manager for ACH Services for Multi-Platform...

Security Bulletin: Financial Transaction Manager for ACH Services has a potential Information Disclosure vulnerability (CVE-2018-1393)

Summary Financial Transaction Manager FTM for ACH Services has addressed a potential Information Disclosure vulnerability for some web services in the web services component. Vulnerability Details CVEID: CVE-2018-1393 DESCRIPTION: IBM Financial Transaction Manager for ACH Services for...

Security Bulletin: Financial Transaction Manager for ACH Services has a potential Denial of Service (DOS) vulnerability (CVE-2018-1391)

Summary Financial Transaction Manager FTM for ACH Services has addressed a potential Denial of Service DOS vulnerability for some web services in the web services component. Vulnerability Details CVEID: CVE-2018-1391 DESCRIPTION: IBM Financial Transaction Manager for ACH Services for Multi-Platfo...

Security Bulletin: IBM Tealeaf Customer Experience Replay Server internal proxy accepts connections from external sources (CVE-2016-5968)

Summary The internal HTTP proxy server deployed as part of the IBM Tealeaf Customer Experience Replay Server accepts requests from any network host, not only from local renderers. Vulnerability Details CVEID: CVE-2016-5968 DESCRIPTION: IBM Tealeaf Replay Server allows remote attackers to use one ...

Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Application Server for Bluemix

Summary WebSphere Application Server may have insecure file permissions after custom startup scripts are run. The custom startup script will not pull the umask from the server.xml. This may cause some log files to have different permissions then expected. There is an information disclosure in the...

Security Bulletin: A Security vulnerability has been identified in IBM WebSphere Application Server bundled with IBM WebSphere Application Server Patterns and IBM WebSphere Application Server for Cloud (CVE-2017-1501 )

Summary There is a potential security vulnerability in the WebSphere Application Server Admin Console if you have updated the web services security bindings settings. If you changed the cipher suites in the web services security bindings settings they may not have been saved properly and thus be...

Security Bulletin: Potential security vulnerability in the WebSphere Application Server Admin Console (CVE-2017-1501)

Summary There is a potential security vulnerability in the WebSphere Application Server Admin Console if you have updated the web services security bindings settings. If you changed the cipher suites in the web services security bindings settings they may not have been saved properly and thus be...

CVE-2018-5488

NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation JMX RMI service bound to the network, and are susceptible to unauthenticated...

CVE-2018-5488

NetApp SANtricity Web Services Proxy and SANtricity Storage Manager are affected by an unauthenticated remote code execution due to JMX RMI being bound to the network. Affected products: NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Man...

CVE-2018-5488

NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation JMX RMI service bound to the network, and are susceptible to unauthenticated...

CVE-2017-16013

hapi is a web and services application framework. When hapi = 15.0.0 = 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached...

CVE-2018-10611

Java remote method invocation RMI input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services...

Remote code execution

Java remote method invocation RMI input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services...