1256 matches found
CVE-2017-12624
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service DoS attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack...
com.ganshane.lichen:lichen-creeper (>=0.5.9 <=0.5.10.2), com.ganshane.lichen:lichen-node (>=0.5.9 <=0.5.10.2) +45 more potentially affected by CVE-2019-10071 via org.apache.tapestry:tapestry-core (>=5.4-beta-22 <=5.4.4)
org.apache.tapestry:tapestry-core MAVEN version =5.4-beta-22, =0.5.9, =0.5.9, =0.5.9, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.92-RELEASE, =0.98 - de.julielab:julie-elastic-query-components =1.0.3 - de.julielab:julielab-elastic-query-components =1.2.0 -...
Clever New DDoS Attack Gets a Lot of Bang for a Hacker's Buck
By exploiting the WS-Discovery protocol, a new breed of DDoS attack can get a huge rate of return...
NewStart CGSL MAIN 4.05 : xmlrpc3 Vulnerability (NS-SA-2019-0136)
The remote NewStart CGSL host, running version MAIN 4.05, has xmlrpc3 packages installed that are affected by a vulnerability: - A flaw was discovered in the Apache XML-RPC ws-xmlrpc library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use...
yump3.ws Cross Site Scripting vulnerability
Security Researcher geeknik Helped patch 8594 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting yump3.ws website and its users. Following coordinated and...
ipswitch WS_FTP Server Path Traversal Vulnerability
ipswitch WSFTP Server is an FTP service program for Windows systems. A path traversal vulnerability exists in SSHServerAPI.dll in ipswitch WSFTP Server versions prior to 2018 8.6.1. An attacker can exploit this vulnerability to achieve remote code execution...
CVE-2019-12146
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WSFTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized director...
CVE-2019-12145
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WSFTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose path names on the host operating system...
CVE-2019-12144
An issue was discovered in SSHServerAPI.dll in Progress ipswitch WSFTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses th...
CVE-2019-12143
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WSFTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose WSFTP usernames as well as filenames...
02moduletest (=1.0.0), 10er10 (=0.23.0) +5711 more potentially affected by unknown CVE via ws (>=0.3.1 <=1.1.4)
ws NPM version =0.3.1, =0.0.1, =1.0.2, =0.0.1, =1.0.1, =0.1.0, =0.0.1, =0.0.15, =0.9.0, =0.0.1, =0.0.1, =0.1.2, =1.0.0-alpha1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5V72-XG48-5RPM...
jackson-databind: exfiltration/XXE in some JDK classes
A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the slf4j, flex messaging, sun DRSHelper and JAX-WS gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...
jackson-databind: exfiltration/XXE in some JDK classes
A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the slf4j, flex messaging, sun DRSHelper and JAX-WS gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...
Important: Red Hat Security Advisory: openwsman security update
An update for openwsman is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
RHEL 8 : openwsman (RHSA-2019:0972)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0972 advisory. Openwsman is a project intended to provide an open source implementation of the Web Services Management specification WS-Management and to expose...
Fedora Update for openwsman FEDORA-2019-64b384de9b
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Denial Of Service (DoS)
Java SE and Java SE Embedded are vulnerable to denial of service attacks. A remote, unauthenticated attacker could submit malicious input leading to the exploitation of the flawed JAX-WS component causing partial denial of service conditions...
Denial Of Service (DoS)
Java SE, Java SE Embedded and JRockit are vulnerable to denial of service attacks. A remote, unauthenticated attacker could exploit the flawed JAX-WS component to partially access data and cause partial denial of service conditions...