[ MDVSA-2013:016 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:016 http://www.mandriva.com/security/ Package : php Date : February 28, 2013 Affected: 2011., Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in php: PHP...

Mandriva Linux Security Advisory : php (MDVSA-2013:016)

Multiple vulnerabilities has been discovered and corrected in php : PHP does not validate the configration directive soap.wsdlcachedir before writing SOAP wsdl cache files to the filesystem. Thus an attacker is able to write remote wsdl files to arbitrary locations CVE-2013-1635. PHP allows the u...

CVE-2013-0466

Cross-site scripting XSS vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2, when wsdl support is enabled on a SOAPInput node, allows remote attackers to inject arbitrary web script or HTML via a wsdl request that is not properly handled during construction of...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2, when wsdl support is enabled on a SOAPInput node, allows remote attackers to inject arbitrary web script or HTML via a wsdl request that is not properly handled during construction of...

CVE-2013-0466

CVE-2013-0466 affects IBM WebSphere Message Broker (7.0 prior to 7.0.0.6 and 8.0 prior to 8.0.0.2) where wsdl support on a SOAPInput node can trigger cross-site scripting. The root cause is improper handling during construction of an error message, allowing remote script/HTML injection via a wsdl...

CVE-2012-5786

The wsdlfirsthttps sample code in distribution/src/main/release/samples/wsdlfirsthttps/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-midd...

Nortel Contact Recording Centralized Archive 6.5.1 - SQL Injection

Nortel Contact Recording Centralized Archive 6.5.1 - SQL Injection EyrAPIConfiguration /EyrAPIConfiguration/ ... at the following url: http://host:8080/EyrAPI/EyrAPIConfiguration/EyrAPIConfigurationIf Vulnerability: without prior authentication, you can reach a web service with various methods...

Nortel Contact Recording Centralized Archive 6.5.1 - SQL Injection

EyrAPIConfiguration /EyrAPIConfiguration/ ... at the following url: http://host:8080/EyrAPI/EyrAPIConfiguration/EyrAPIConfigurationIf Vulnerability: without prior authentication, you can reach a web service with various methods availiable, as described inside the associated wsdl, see file:...

Fedora Update for php-nusoap FEDORA-2010-14058

Check for the Version of php-nusoap OpenVAS Vulnerability Test Fedora Update for php-nusoap FEDORA-2010-14058 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

MantisBT nusoap/nusoap.php NuSOAP WSDL XSS

The installation of MantisBT on the remote host includes a version of NuSOAP that fails to sanitize user input passed via PHP's $SERVER'PHPSELF' variable to 'nusoap/nusoap.php' via 'soap/mantisconnect.php' before using it to generate dynamic HTML content. An unauthenticated, remote attacker may b...

Mantis 1.2.x < 1.2.3 Cross-Site Scripting Vulnerability

Binary data 5676.prm...

[SECURITY] Fedora 14 Update: php-nusoap-0.9.5-1.fc14

NuSOAP is a rewrite of SOAPx4, provided by NuSphere and Dietrich Ayala. It is a set of PHP classes - no PHP extensions required - that allow developers to create and consume web services based on SOAP 1.1, WSDL 1.1 and HTTP 1.0/1. 1...

Apache Axis2 Detection (HTTP)

HTTP based detection of Apache Axis2, a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Apache Axis Session Fixation Vulnerability

===== Tempest Security Intelligence - Advisory 02 / 2010 =========== Vulnerability = 'Apache Axis Session Fixation Vulnerability' Authors = 'Tiago Ferreira tiago SPAM tempest.com.br' 'Leandro Oliveira leandro SPAM tempest.com.br' ======== Table of Contents...

JBoss EAP unprivileged local xml file access

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP06 update

Updated JBoss Enterprise Application Platform JBoss EAP 4.2 packages that fix various issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.2.0.CP06. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

SOAP '.wsdl' File Detection

Binary data 4675.prm...

Code injection

BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks...

CVE-2008-0863

BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks...

CVE-2008-0863

BEA WebLogic Server and WebLogic Express 9.0/9.1 expose the web service WSDL and security policies, allowing remote retrieval of sensitive information and the potential to launch further attacks. Affected component: WebLogic web services configuration; root cause: exposed WSDL/security policy end...