CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

The vulnerability of the XML security component of the Oracle Web Services Manager application on the Oracle Fusion Middleware software platform allows a perpetrator to gain unauthorized access to protected data or to modify, add, or delete protected data.

The vulnerability of the XML Security component of the Oracle Web Services Manager application in the Oracle Fusion Middleware software platform is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protected data o...

CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

CVE-2023-21862

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware component: XML Security component. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web...

Oracle Web Services Manager 安全漏洞

Oracle Web Services Manager OWSM is a service manager from Oracle Corporation that provides a policy framework for consistently managing and securing Web services across an organization. A security vulnerability exists in Oracle Web Services Manager version 12.2.1.4.0. An unauthenticated attacker...

CVE-2023-21862

CVE-2023-21862 affects Oracle Web Services Manager (OWSM) within Oracle Fusion Middleware, specifically the XML Security component in version 12.2.1.4.0. The issue stems from insufficient input validation, enabling an unauthenticated attacker with network access via HTTP to compromise OWSM, poten...

PT-2023-1241 · Oracle · Oracle Web Services Manager

Name of the Vulnerable Software and Affected Versions: Oracle Web Services Manager version 12.2.1.4.0 Description: The issue is related to insufficient input validation in the XML Security component of Oracle Web Services Manager, part of Oracle Fusion Middleware. This easily exploitable flaw...

Vulnerability of the web service of Google Chrome and Microsoft Edge, allowing a hacker to execute arbitrary code

The vulnerability of the Google Chrome and Microsoft Edge browser services is related to type conversion errors. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

USN-5802-1: Linux kernel vulnerabilities

It was discovered that the NFSD implementation in the Linux kernel did not properly handle some RPC messages, leading to a buffer overflow. A remote attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-43945 Tamás Koczka discovered that th...

Siemens SINEC NMS 路径遍历漏洞

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in a single tool. This simplifies the installation and management of all network services related to industrial networks.A path traversal vulnerability exists in Siemens SINEC INS, which...

Security Bulletin: IBM Connect:Direct Web Services vulnerable to sensitive information exposure due to PostgreSQL (CVE-2022-41946)

Summary IBM Connect:Direct Web Services has addressed a PostgreSQL vulnerability. Vulnerability Details CVEID:CVE-2022-41946 DESCRIPTION: Postgresql JDBC could allow a local authenticated attacker to obtain sensitive information, caused by not limit access to created readable files in the...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42004)

Summary IBM Sterling Connect:Direct Web Services has addressed a denial of service vulnerability due to FasterXML jackson-databind. Vulnerability Details CVEID:CVE-2022-42004 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in in the...

PT-2023-12722 · Spinnaker +2 · Spinnaker +2

Name of the Vulnerable Software and Affected Versions: Spinnaker's Rosco microservice versions prior to 1.29.2, 1.28.4, and 1.27.3 Description: Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine...

CVE-2022-4725

A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to...

AWS SDK for Android 代码问题漏洞

AWS SDK for Android is an AWS SDK for Android open source by AWS Amplify. A code issue vulnerability exists in AWS SDK for Android prior to version 2.59.01, which stems from a function in the aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java file in the component XML Parser...

AWS SDK for Android 加密问题漏洞

AWS SDK for Android is an AWS SDK for Android open source by AWS Amplify. A security vulnerability exists in AWS SDK for Android that stems from sending an unencrypted hash of plaintext along with ciphertext as a metadata field. If the hash is readable by an attacker, the hash can be used to brut...

PT-2022-28039 · Amazon · Aws Sdk

Name of the Vulnerable Software and Affected Versions: AWS SDK version 2.59.0 Description: A critical issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request...

Top American Online Ed Platform Leaks 22TB of Data

By Waqas In total, 117 million files were exposed due to two misconfigured Amazon Web Services S3 buckets. This is a post from HackRead.com Read the original post: Top American Online Ed Platform Leaks 22TB of Data...

CVE-2022-3073

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser...