cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding

A server-side request forgery SSRF vulnerability was found in Apache CXF. This issue occurs in attacks on webservices that take at least one parameter of any type, and when Aegisdatabind is used. Users of other data bindings including the default databinding are not impacted...

Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to Bouncy Castle BC-FJA

Summary IBM Sterling Connect:Direct Web Service 6.1 and 6.2 is vulnerable to BC version 1.75 . We have upgraded to version 1.78 to fix CVE-2022-45146. Vulnerability Details CVEID:CVE-2022-45146 DESCRIPTION: The Legion of the Bouncy Castle BC-FJA could allow a remote attacker to obtain sensitive...

CVE-2024-32862

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32862

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32862

ExacqVision Web Service (Johnson Controls) is affected by CVE-2024-32862 due to a permissive Cross-domain Policy with Untrusted Domains in its CORS handling. The vulnerability impacts exacqVision Web Service versions prior to 24.06 (notably 22.12.1.0 per ICS alert) and could allow an attacker to ...

CVE-2024-32862 exacqVision CORS

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32862 exacqVision CORS

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32864

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32863

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery CSRF...

CVE-2024-32863

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery CSRF...

CVE-2024-32864 exacqVison - HTTPS Session Establishment

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864 exacqVison - HTTPS Session Establishment

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864

Summary: CVE-2024-32864 affects Johnson Controls exacqVision Web Service prior to version 24.06, where HTTPS is not enforced under certain conditions, enabling potential exposure of sensitive information via cleartext transmission (CWE-319). The vulnerability affects exacqVision Web Service versi...

CVE-2024-32863

Johnson Controls exacqVision Web Service is affected up to version 24.03 by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2024-32863). The issue allows performing state-changing operations with administrative privileges and has CVSSv3.1 base score 6.8 (vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H...

PT-2024-5518 · Unknown · Exacqvision Web Service

Name of the Vulnerable Software and Affected Versions: ExacqVision Web Services affected versions not specified Description: The issue is related to the ExacqVision Web Services, which under certain circumstances does not provide sufficient protection from untrusted domains. This is due to...

CVE-2024-32864: Cleartext Transmission of Sensitive Information

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

PT-2024-5521

Name of the Vulnerable Software and Affected Versions exacqVision Web Services affected versions not specified Description The issue is related to the implementation of the HTTPS protocol in the exacqVision Web Service system, which may lead to the transmission of credentials in an unencrypted...

CVE-2024-32862: Permissive Cross-domain Policy with Untrusted Domains

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

PT-2024-5519 · Tyco Security Products · Exacqvision Web Service

Name of the Vulnerable Software and Affected Versions: exacqVision Web Services affected versions not specified Description: The issue is related to Cross-Site Request Forgery CSRF, which can be exploited under certain circumstances. This could allow a remote attacker to perform a CSRF attack...