CVE-2013-2934

Citrix CloudPortal Services Manager aka Cortex 10.0 before Cumulative Update 3 does not properly restrict access to web services, which has unspecified impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162...

CVE-2013-2934

Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 is affected. The issue is that web services access is not properly restricted, with unspecified impact and attack vectors. Root cause details are not provided beyond this restriction gap. No exploitation or specific ...

PT-2013-4050

Name of the Vulnerable Software and Affected Versions Citrix CloudPortal Services Manager aka Cortex versions prior to 10.0 Cumulative Update 3 Description The issue is related to improper restriction of access to web services, which may have an unspecified impact. The attack vectors for this iss...

Fedora Update for wss4j FEDORA-2013-14106

Check for the Version of wss4j OpenVAS Vulnerability Test Fedora Update for wss4j FEDORA-2013-14106 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

Fedora Update for wss4j FEDORA-2013-14159

Check for the Version of wss4j OpenVAS Vulnerability Test Fedora Update for wss4j FEDORA-2013-14159 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

[SECURITY] Fedora 19 Update: wss4j-1.6.10-1.fc19

The Apache WSS4J project provides a Java implementation of the primary security standards for Web Services...

[SECURITY] Fedora 18 Update: wss4j-1.6.10-1.fc18

The Apache WSS4J project provides a Java implementation of the primary security standards for Web Services...

SA-CONTRIB-2013-062 - RESTful Web Services (RESTWS) - Access Bypass

This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The module doesn't sufficiently check for field level access when preforming entity write operations on POST and PUT requests. It also do...

Authentication flaw

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.7 does not properly perform authentication for unspecified web services, which allows remote attackers to issue requests in the context of an arbitrary user's active session via unknown vectors...

CVE-2013-2993

IBM WebSphere Commerce 6.x up to 6.0.0.11 and 7.x up to 7.0.0.7 contains an authentication flaw in unspecified web services. The issue allows remote attackers to issue requests in the context of an arbitrary user’s active session via unknown vectors. Affected component is the authentication handl...

PT-2013-4085

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce versions 6.x through 6.0.0.11 IBM WebSphere Commerce versions 7.x through 7.0.0.7 Description The issue is related to improper authentication for web services, allowing remote attackers to issue requests in the context o...

Sybase EAServer 6.3.1 - Multiple Vulnerabilities

Sybase EAServer fully supports all the Web services standards and enables enterprises to rapidly expose business functions as Web services. EAServer also provides a graphical interface to automate the publication and management of your company’s Web services. Today, EAServer supports EJB and...

Sybase EAServer 6.3.1 Directory Traversal / XXE Injection / Command Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Sybase EAServer vulnerable version: =6.3.1 fixed version: vendor did not supply version information CVE number: - impact: critical...

SEC Consult SA-20130719-0 :: Multiple vulnerabilities in Sybase EAServer

SEC Consult Vulnerability Lab Security Advisory 20130719-0 ======================================================================= title: Multiple vulnerabilities product: Sybase EAServer vulnerable version: =6.3.1 fixed version: vendor did not supply version information CVE number: - impact:...

Fedora 19 : livecd-tools-19.4-1.fc19 (2013-9827)

Some fixed for running from F19 host. The livecd-tools package provides support for reading and executing Kickstart files in order to create a system image. It was discovered that livecd-tools gave the root user an empty password rather than leaving the password locked in situations where no...

Fedora 17 : livecd-tools-17.17-1.fc17 (2013-9111)

The livecd-tools package provides support for reading and executing Kickstart files in order to create a system image. It was discovered that livecd-tools gave the root user an empty password rather than leaving the password locked in situations where no 'rootpw' directive was used or when the...

apache-cxf: XML encryption backwards compatibility attacks

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

Apache CXF Denial of Service Vulnerabilities Patched

The Apache Software Foundation has patched a denial of service vulnerability in the XML parser of the Apache CXF Web services framework. Researchers, Andreas Falkenberg from Sec Consult Vulnerability Labs, and Christian Mainka, Juraj Somorovsky, and Joerg Schwenk from Ruhr-University Bochum,...

Important: Red Hat Security Advisory: python-keystoneclient security, bug fix, and enhancement update

Updated python-keystoneclient packages that fix two security issues, one bug, and add one enhancement are now available for Red Hat OpenStack 3.0 Grizzly Preview. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CV...

jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key

A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks...