CVE-2019-3707 WS-MAN Authentication Bypass Vulnerability

Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted input data to the WS-MAN interface...

CVE-2019-3707

CVE-2019-3707 affects Dell EMC iDRAC9 before version 3.30.30.30. An authentication bypass vulnerability exists where a remote attacker can bypass authentication by sending specially crafted input data to the WS-MAN interface. Exploitation details in the connected documents are identical across so...

Fedora Update for openwsman FEDORA-2019-348166f7fd

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: openwsman-2.6.8-5.fc30

Openwsman is a project intended to provide an open-source implementation of the Web Services Management specification WS-Management and to expose system management information on the Linux operating system using the WS-Management protocol. WS-Management is based on a suite of web services...

[SECURITY] Fedora 29 Update: openwsman-2.6.5-9.fc29

Openwsman is a project intended to provide an open-source implementation of the Web Services Management specification WS-Management and to expose system management information on the Linux operating system using the WS-Management protocol. WS-Management is based on a suite of web services...

[SECURITY] Fedora 28 Update: openwsman-2.6.5-4.fc28

Openwsman is a project intended to provide an open-source implementation of the Web Services Management specification WS-Management and to expose system management information on the Linux operating system using the WS-Management protocol. WS-Management is based on a suite of web services...

Oracle Linux 7 : openwsman (ELSA-2019-0638)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0638 advisory. - Update the fix for CVE-2019-3816 Resolves: 1668657 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...

1tp (>=0.0.1, <=0.11.2), @balderdash/sails-edge (>=0.12.0-edge9, <=0.50.0) +774 more potentially affected by CVE-2016-10542 via ws (>=1.0.0, <=1.1.0)

ws NPM version =1.0.0, =0.0.1, =0.12.0-edge9, =0.0.1, =1.8.4, =1.0.0, =1.0.30, =0.0.5, =1.1.1, =0.1.0, =1.0.14, =3.0.2 and more Source cves: CVE-2016-10542 Source advisory: OSV:GHSA-6663-C963-2GQG...

DoS due to excessively large websocket message in ws

Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload. Recommendation Update to version 1.1.1 or later. Alternatively, set the maxpayload option fo...

wiotpwidgets (0.1.0) potentially affected by CVE-2016-10518 via ws (1.0.0)

ws NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ws and may be impacted: - wiotpwidgets 0.1.0 Source cves: CVE-2016-10518 Source advisory: OSV:GHSA-2MHH-W6Q8-5HXW...

Remote Memory Disclosure in ws

Versions of ws prior to 1.0.1 are affected by a remote memory disclosure vulnerability. In certain rare circumstances, applications which allow users to control the arguments of a client.ping call will cause ws to send the contents of an allocated but non-zero-filled buffer to the server. This ma...

GHSA-2MHH-W6Q8-5HXW Remote Memory Disclosure in ws

Versions of ws prior to 1.0.1 are affected by a remote memory disclosure vulnerability. In certain rare circumstances, applications which allow users to control the arguments of a client.ping call will cause ws to send the contents of an allocated but non-zero-filled buffer to the server. This ma...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

XML External Entity Injection (XXE)

spring-ws is vulnerable to XML external entity injection XXE. The external document type definition external entities is not disabled by default and allows a remote attacker to perform XXE attacks via malicious XML data input...

WSS4JInInterceptor Bypasses WS Security Processing

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

XML Encryption Backwards Compatibility Attack

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

ws-nutri.de XSS vulnerability

Open Bug Bounty ID: OBB-714932 Description| Value ---|--- Affected Website:| ws-nutri.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, and org.apache.cxf.fediz:fediz-spring2

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4...

Easy File Sharing WS v7.2 - (Domain Name) Buffer Overflow

Document Title: =============== Easy File Sharing WS v7.2 - Domain Name Buffer Overflow References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2154 Release Date: ============= 2018-10-04 Vulnerability Laboratory ID VL-ID: ====================================...