CVE-2013-2934

Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 is affected. The issue is that web services access is not properly restricted, with unspecified impact and attack vectors. Root cause details are not provided beyond this restriction gap. No exploitation or specific ...

Fedora Update for wss4j FEDORA-2013-14106

Check for the Version of wss4j OpenVAS Vulnerability Test Fedora Update for wss4j FEDORA-2013-14106 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

Fedora Update for wss4j FEDORA-2013-14159

Check for the Version of wss4j OpenVAS Vulnerability Test Fedora Update for wss4j FEDORA-2013-14159 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

[SECURITY] Fedora 19 Update: wss4j-1.6.10-1.fc19

The Apache WSS4J project provides a Java implementation of the primary security standards for Web Services...

[SECURITY] Fedora 18 Update: wss4j-1.6.10-1.fc18

The Apache WSS4J project provides a Java implementation of the primary security standards for Web Services...

SA-CONTRIB-2013-062 - RESTful Web Services (RESTWS) - Access Bypass

This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The module doesn't sufficiently check for field level access when preforming entity write operations on POST and PUT requests. It also do...

Authentication flaw

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.7 does not properly perform authentication for unspecified web services, which allows remote attackers to issue requests in the context of an arbitrary user's active session via unknown vectors...

CVE-2013-2993

IBM WebSphere Commerce 6.x up to 6.0.0.11 and 7.x up to 7.0.0.7 contains an authentication flaw in unspecified web services. The issue allows remote attackers to issue requests in the context of an arbitrary user’s active session via unknown vectors. Affected component is the authentication handl...

Sybase EAServer 6.3.1 - Multiple Vulnerabilities

Sybase EAServer fully supports all the Web services standards and enables enterprises to rapidly expose business functions as Web services. EAServer also provides a graphical interface to automate the publication and management of your company’s Web services. Today, EAServer supports EJB and...

Sybase EAServer 6.3.1 Directory Traversal / XXE Injection / Command Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Sybase EAServer vulnerable version: =6.3.1 fixed version: vendor did not supply version information CVE number: - impact: critical...

SEC Consult SA-20130719-0 :: Multiple vulnerabilities in Sybase EAServer

SEC Consult Vulnerability Lab Security Advisory 20130719-0 ======================================================================= title: Multiple vulnerabilities product: Sybase EAServer vulnerable version: =6.3.1 fixed version: vendor did not supply version information CVE number: - impact:...

Fedora 19 : livecd-tools-19.4-1.fc19 (2013-9827)

Some fixed for running from F19 host. The livecd-tools package provides support for reading and executing Kickstart files in order to create a system image. It was discovered that livecd-tools gave the root user an empty password rather than leaving the password locked in situations where no...

Fedora 17 : livecd-tools-17.17-1.fc17 (2013-9111)

The livecd-tools package provides support for reading and executing Kickstart files in order to create a system image. It was discovered that livecd-tools gave the root user an empty password rather than leaving the password locked in situations where no 'rootpw' directive was used or when the...

apache-cxf: XML encryption backwards compatibility attacks

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

Apache CXF Denial of Service Vulnerabilities Patched

The Apache Software Foundation has patched a denial of service vulnerability in the XML parser of the Apache CXF Web services framework. Researchers, Andreas Falkenberg from Sec Consult Vulnerability Labs, and Christian Mainka, Juraj Somorovsky, and Joerg Schwenk from Ruhr-University Bochum,...

Important: Red Hat Security Advisory: python-keystoneclient security, bug fix, and enhancement update

Updated python-keystoneclient packages that fix two security issues, one bug, and add one enhancement are now available for Red Hat OpenStack 3.0 Grizzly Preview. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CV...

jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key

A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks...

Two-Factor Authentication Options for Web Services

LinkedIn is the latest in a long line of high profile Internet services companies to offer two-factor authentication to its user base, joining Twitter, Evernote, Gmail and myriad others. And much like those other services, the move to a stronger form authentication is a reactionary one, coming on...

Microsoft .NET Framework 身份验证绕过漏洞(CVE-2013-1337)(MS13-040)

BUGTRAQ ID: 59790 CVECAN ID: CVE-2013-1337 .NET就是微软的用来实现XML，Web Services，SOA（面向服务的体系结构service-oriented architecture）和敏捷性的技术。.NET Framework是微软开发的软件框架，主要运行在Microsoft Windows上。 当设置自定义 WCF 终结点身份验证时，Microsoft .NET Framework...

OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows local users to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented o...