CVE-2020-9044 Metasys Improper Restriction of XML External Entity Reference

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...

Citrix Gateway Cache Overflow Vulnerability

Citrix Gateway is a customer-managed solution that can be deployed locally or on any public cloud, such as AWS, Azure or Google Cloud Platform. Citrix Gateway has a security vulnerability. An attacker can exploit the vulnerability to cache poisoning...

The vulnerability of the OpenId Connect service’s framework for Apache CXF allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the OpenId Connect service for Apache CXF web services is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

U.S. Dept Of Defense: SharePoint Web Services Exposed to Anonymous Access Users

Summary: Any unauthenticated/anonymous users are able to access the SharePoint Web Services .wsdl files for the █████ Initiative website. Description: The SharePoint installation for this particular site allows any user to access the spdisco.aspx on the web server which discloses the location of ...

Information Disclosure Vulnerability in Multiple Moxa Products (CNVD-2020-18364)

Moxa MB3170/MB3270/MB3180/MB3280/MB3480/MB3660 series is an advanced Ethernet gateway device manufactured by moxa Taiwan. An information disclosure vulnerability exists in multiple Moxa products, which can be exploited by attackers to gain unauthorized access to sensitive information and user nam...

Deal: Cloud And Networking Certification Training ~ Get 97% OFF

Cloud computing and networking are two of the most significant areas of growth in the IT business. Companies need engineers who can maintain distributed software and keep the company connected. If you want to work in either niche, the Essential Cloud & Networking Certification Training Bundle...

USN-4286-2: Linux kernel (Xenial HWE) vulnerabilities

USN-4286-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 ESM. It was discovered that the Linux kernel did not properly clear data structures on...

USN-4287-1: Linux kernel vulnerabilities

It was discovered that the Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors. A local attacker could use this to expose sensitive information. CVE-2019-14615 It was discovered that the Atheros 802.11ac wireless USB device driver in the...

IBM WebSphere Application Server Memory Corruption Vulnerability

IBM WebSphere Application Server WAS is an application server product from IBM in the United States. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. IBM WebSphere Application Server memory corruption vulnerability. N...

The vulnerability of the com.sun.net.ssl component in the Apache CXF web service framework allows a attacker to execute a type of “man-in-the-middle” attack.

The vulnerability of the com.sun.net.ssl component in Apache CXF web services is related to deficiencies in handling exceptional states. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” attack...

Amazon AWS JavaScript S3 Explorer Cross-Site Scripting Vulnerability

Amazon AWS JavaScript S3 Explorer is a set of S3 browsers. A cross-site scripting vulnerability exists in Amazon AWS JavaScript S3 Explorer explorer.js, which can be exploited by remote attackers to inject malicious script or HTML code, which can be used to gain access to sensitive information or...

Cross site scripting

The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...

CVE-2013-4225

The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...

CVE-2013-4225

The RESTful Web Services (RESTWS) module for Drupal is vulnerable in versions 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 due to insufficient restriction of access to entity write operations. This allows remote authenticated users with permissions such as "access resource node" and "create ...

Adobe Addresses Critical Flash, Framemaker Flaws

Adobe has released patches addressing a wave of critical flaws in its Framemaker and Flash Player products, which, if exploited, could lead to arbitrary code-execution. Overall, Adobe stomped out flaws tied to 42 CVEs for its regularly scheduled February updates, with 35 of those flaws being...

Security Updates for Exchange (February 2020)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could gain the...

F5 Networks BIG-IP : BIG-IP TMM AWS vulnerability (K00025388)

While processing specifically crafted traffic using the default 'xnet' driver, BIG-IP Virtual Edition VE instances hosted in Amazon Web Services AWS may experience a Traffic Management Microkernel TMM restart. CVE-2020-5856 Impact A remote attacker may be able to perform a denial-of-service DoS...

Prepare for Cisco, CompTIA, and More IT Certifications with this Bundle

Exams are pretty important in professional IT. You can have all the practical knowledge in the world, but technical recruiters want to see certificates. If you want to improve your resume, the Complete 2020 IT Certification Exam Prep Mega Bundle will help you ace nine of the most important exams...

Exposed API

centreon/centreon serves API without the need for authentication. Various web services were fully accessible using external.php which would allow an unauthenticated attacker to perform actions on the server...

CVE-2019-3773

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...