CVE-2019-12143

A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WSFTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose WSFTP usernames as well as filenames...

1tp (>=0.0.1, <=0.11.2), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +3212 more potentially affected by unknown CVE via ws (>=0.6.3, <=1.1.4)

ws NPM version =0.6.3, =0.0.1, =1.0.2, =0.0.1, =0.0.15, =0.0.1, =0.1.2, =0.2.3, =1.0.1, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.2.4-20180621213746, =0.1.0-20180815155955, =0.17.5, =0.12.0-edge9, =0.50.0 and more Source cves: unknown CVE Source advisory...

100notes-comments (0.1.1), @_inlimbo/nativeui (>=0.0.1, <=0.0.9) +2266 more potentially affected by unknown CVE via ws (>=2.0.0, <=3.2.0)

ws NPM version =2.0.0, =0.0.1, =1.16.0, =1.6.0, =1.5.3, =0.0.1, =2015.7.15-1, =0.0.1, =0.0.74, =0.1.0, =1.0.0-alpha10, =0.1.0, =0.3.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5V72-XG48-5RPM...

jackson-databind: exfiltration/XXE in some JDK classes

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the slf4j, flex messaging, sun DRSHelper and JAX-WS gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

jackson-databind: exfiltration/XXE in some JDK classes

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the slf4j, flex messaging, sun DRSHelper and JAX-WS gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

Important: Red Hat Security Advisory: openwsman security update

An update for openwsman is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Fedora Update for openwsman FEDORA-2019-64b384de9b

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

RHEL 8 : openwsman (RHSA-2019:0972)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0972 advisory. Openwsman is a project intended to provide an open source implementation of the Web Services Management specification WS-Management and to expose...

Denial Of Service (DoS)

Java SE and Java SE Embedded are vulnerable to denial of service attacks. A remote, unauthenticated attacker could submit malicious input leading to the exploitation of the flawed JAX-WS component causing partial denial of service conditions...

Denial Of Service (DoS)

Java SE, Java SE Embedded and JRockit are vulnerable to denial of service attacks. A remote, unauthenticated attacker could exploit the flawed JAX-WS component to partially access data and cause partial denial of service conditions...

Arbitrary Code Execution

java is vulnerable to arbitrary code execution. The vulnerability exists through JAX-WS...

Authorization Bypass

openjdk is vulnerable to authorization bypass. An unspecified vulnerability allows remote attackers to affect integrity via vectors related to JAX-WS...

Information Disclosure

openjdk is vulnerable to information disclosure. An unspecified vulnerability allows remote attackers to affect confidentiality via vectors related to JAX-WS...

Spoofable Tokens

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

Authentication Bypass

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.1, and includes bug fixes and enhancements. Refer to the 6.1.0 Release Notes for information on the...

Improper Access Control

OpenJDK is vulnerable to improper access control vulnerability. The vulnerability exists in the Java Runtime Environment JRE component in Oracle Java SE. A local user could affect the confidentiality via vector related JAX-WS...

Access Restriction Bypass

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...

CentOS 7 : openwsman (CESA-2019:0638)

An update for openwsman is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Command Execution Vulnerability in M8600E-WS-ED of Riptide Networks Inc.

M8600E-WS-ED is a wireless control service card designed for cloud architecture network by Ruijie Networks, which is suitable for RG-S8600E series new-generation cloud architecture network core switches. A command execution vulnerability exists in Ruijie Networks M8600E-WS-ED. An attacker can...

Authentication flaw

Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted input data to the WS-MAN interface...