CVE-2014-0107 Description The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0107 https://issues.apache.org/jira/browse/XALANJ-2435 Project Category n/a Tags data configuration Date Disclosed 2014-04-15 Date Discovered 2013-12-03 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? …
Read More
CVE-2014-0095 Description java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0095 http://mail-archives.apache.org/mod_mbox/www-announce/201405.mbox/%3C53848920.9070009@apache.org%3E Project Category n/a Tags data Date Disclosed 2014-05-31 Date Discovered 2013-12-03 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2013-6440 Description The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6440 http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml https://issues.shibboleth.net/jira/browse/JXT-105 https://issues.shibboleth.net/jira/browse/JXT-107 http://shibboleth.net/community/advisories/secadv_20131213.txt Project Category n/a Tags data functional Date Disclosed 2014-02-14 Date Discovered 2013-11-04 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2013-5823 Description Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via unknown vectors related to Security. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5823 https://issues.apache.org/jira/browse/SANTUARIO-334 https://bugzilla.redhat.com/show_bug.cgi?id=1019145 Project Category n/a Tags data Date Disclosed 2013-10-16 Date Discovered 2013-09-18 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2013-4002 Description XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names. Mitigation We recommend upgrading to a version of this…
Read More
CVE-2013-2160 Description The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2160 https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc Project Category n/a Tags data functional Date Disclosed 2013-08-19 Date Discovered 2013-02-19 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2013-2035 Description Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2035 http://tools.cisco.com/security/center/viewAlert.x?alertId=32047 Project Category n/a Tags data Date Disclosed 2013-08-28 Date Discovered 2013-02-19 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2013-1879 Description Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message." Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. `activemq-core` was moved to `activemq-client` in version 5.8 Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1879 https://issues.apache.org/jira/browse/AMQ-4397 https://exchange.xforce.ibmcloud.com/vulnerabilities/85586 Project Category n/a Tags data Date Disclosed 2013-07-18 Date Discovered 2013-02-19 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2013-1768 Description The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1768 http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html Project Category n/a Tags data functional Date Disclosed 2013-07-11 Date Discovered 2013-02-19 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2012-5633 Description The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. If upgrading is not an option this vulnerability can be mitigated by removing URIMappingInterceptor from use or by utilizing WS-SecurityPolicy. Ref: http://cxf.apache.org/cve-2012-5633.html Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5633 http://cxf.apache.org/cve-2012-5633.html Project Category n/a Tags data configuration functional Date Disclosed 2013-03-12 Date Discovered 2012-10-24 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us…
Read More
