cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (=3.1.0.RELEASE), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.RELEASE <=3.1.0.RELEASE) +1253 more potentially affected by CVE-2016-8739 via org.apache.cxf:cxf-core (>=3.1.0 <=3.1.8)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =2.6.3, =1.2.18, =5.0.0, =6.0.1 - com.bilalalp:cxfclientlogger =1.0 - com.bilalalp:cxflogger =1.0 and more Source cves: CVE-2016-8739 Source advisory:...

Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket

Impact If no TLS configuration is provided by the user, the websocket package constructs its own TLS configuration using recommended defaults. When looking up a WSS endpoint using the DNS TXT record method described in XEP-0156: Discovering Alternative XMPP Connection Methods the ServerName field...

CVE-2020-20471

White Shark System WSS 1.3.2 has an unauthorized access vulnerability in defaultuseredit.php, remote attackers can exploit this vulnerability to escalate to admin privileges...

Information disclosure

White Shark System WSS 1.3.2 has a sensitive information disclosure vulnerability. The ifgetaddbook.php file does not have an authentication operation. Remote attackers can obtain username information for all users of the current site...

CVE-2020-20468

White Shark System WSS 1.3.2 is vulnerable to CSRF. Attackers can use the usereditpassword.php file to modify the user password...

CVE-2020-20474

Vulnerability summary (CVE-2020-20474): White Shark System (WSS) version 1.3.2 contains an SQL injection due to inadequate filtering of the csa_to_user parameter in default_task_edituser.php. This allows remote attackers to potentially retrieve sensitive database information. The connected docume...

CVE-2020-20473

CVE-2020-20473 affects White Shark System (WSS) 1.3.2. Root cause: unsanitized sort parameter in control_task.php, control_project.php, and default_user.php leading to SQL injection. Remote attackers could obtain sensitive database information. Multiple sources (Red Hat, CNVD, NVD, CVE records) c...

CVE-2020-20472

CVE-2020-20472 affects White Shark System (WSS) 1.3.2. The vulnerability is in if_get_addbook.php, which operates without authentication, allowing remote attackers to obtain username information for all users on the current site. The condition arises from lack of access control on that endpoint (...

CVE-2020-20471

CVE-2020-20471 affects White Shark System (WSS) 1.3.2. The vulnerability is in default_user_edit.php and allows unauthorized access with privilege escalation to administrator by remote attackers. CVSS details indicate high impact on confidentiality, integrity, and availability (base score 8.8 / h...

CVE-2020-20470

CVE-2020-20470 affects White Shark System (WSS) 1.3.2. The issue is described as a website physical path leakage/disclosure vulnerability in WSS 1.3.2, with NVD metrics showing a medium base score (CVSS 2.0: 5.0; CVSS 3.1: 5.3) and network attack vector with low complexity. Connected sources cons...

CVE-2020-20469

White Shark System (WSS) 1.3.2 contains a SQL injection in log_edit.php caused by an unfiltered csa_to_user parameter, allowing remote attackers to access sensitive database information. Evidence from CVE entries (CVE-2020-20469) and CNVD/Red Hat/PRION mirrors confirms the vulnerability is trigge...

CVE-2020-20468

White Shark System (WSS) 1.3.2 is affected by CVE-2020-20468, a CSRF vulnerability that allows an attacker to modify a user password via the file user_edit_password.php. The issue is documented in multiple sources (CNVD/CNNVD) as a Cross-Site Request Forgery vulnerability in WSS, enabling passwor...

CVE-2020-20467

White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via the default_task_add.php endpoint. A remote attacker could exploit this to create tasks, exposing data. The vulnerability is documented across multiple feeds (CVE-2020-20467 and related entries) with no public de...

CVE-2020-20466

White Shark System WSS 1.3.2 is vulnerable to unauthorized access via usereditpassword.php, remote attackers can modify the password of any user...

CVE-2020-20466

White Shark System (WSS) version 1.3.2 contains an unauthenticated vulnerability in user_edit_password.php allowing remote attackers to modify passwords of arbitrary users. This CVE-2020-20466 entry is corroborated by multiple sources (Red Hat, CNVD, NVD, and other catalogs) and is described as a...

OpenSSL Vulnerabilities Sep 2020 - Feb 2021

Summary Symantec Network and Information Security NIS products using affected versions of OpenSSL may be susceptible to multiple vulnerabilities. A remote attacker may be able to decrypt encrypted communication from an SSL/TLS connection, downgrade a newly established SSL/TLS connection to SSLv2,...

Tenda Router Zero-Days Emerge in Spyware Botnet Campaign

Two former Tenda router zero-days are anchoring the spread of a Mirai-based botnet called Ttint. In addition to denial-of-service DoS attacks, this variant also has remote-access trojan RAT and spyware capabilities. According to 360Netlab, the botnet is unusual in a few ways. For one, on the RAT...

CVE-2020-15134

Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of its client. Those libraries both use the EM::Connectionstarttls method in EventMachine to implement the TLS handshake whenever a wss: URL i...

UBUNTU-CVE-2020-15133

In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The Faye::WebSocket::Client class uses the EM::Connectionstarttls method in EventMachine to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not...

CVE-2020-15133 Missing TLS certificate verification in Faye Websocket

In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The Faye::WebSocket::Client class uses the EM::Connectionstarttls method in EventMachine to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not...