** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.
As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.
HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information could help an attacker understand the application structure and plan further attacks, potentially resulting in unintended behavior or security impact under certain conditions.
Red Hat JBoss Enterprise Application Platform 8.1.9 includes multiple security fixes addressing vulnerabilities in components such as Netty and Apache CXF. The fixes cover issues like information disclosure via CORS header overwrite, denial of service via uncontrolled form parameters and many attachment headers, authentication bypass via crafted OIDC tokens, and XML External Entity (XXE) vulnerabilities via WSDL/XSD import parsing. These vulnerabilities could impact the confidentiality, availability, and authentication mechanisms of applications running on this platform.
A vulnerability exists in Johnson Controls EasyIO Neo IOManager and Tools Installer version 1.1.0.0 that allows inclusion of functionality from an untrusted control sphere, enabling malicious software updates. This flaw could be exploited by an attacker with limited privileges and user interaction, but requires physical access. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.3. No patch or remediation information is currently available.
Jumis (formerly Tildes Jumis) creates a Microsoft SQL Server login named ##Tilde_JumisAdmin## with a password deterministically derived from the SQL Server name, which is publicly discoverable. This login is part of the sysadmin role, granting full administrative access to the SQL Server instance and all hosted accounting databases. The server also enables xp_cmdshell, allowing attackers with sysadmin access to execute operating system commands. This vulnerability allows any party able to reach the Jumis SQL Server to compute the admin password offline and gain full control without prior authentication.
Fluxbox versions through 1.3.7 have an infinite loop vulnerability in the Menu::updateMenu() function. This flaw allows attackers to cause the window manager to hang by supplying a crafted style with an oversized unbounded menu.titleHeight, resulting in a non-terminating column loop. The attack leads to sustained CPU usage and denial of service during startup.
Agenta versions prior to 0.122.5 have a server-side request forgery (SSRF) vulnerability. This flaw allows workspace members with workflow edit permissions to redirect workflow invocations by specifying arbitrary revision URLs. Exploiting this, attackers can capture secret-resolve Authorization tokens and access provider secrets from the vault API or reach internal and cloud metadata endpoints.
ChatWiki versions before 2.10.0 have an insecure direct object reference (IDOR) vulnerability. Authenticated users can exploit this flaw to modify fast commands belonging to other tenants by submitting arbitrary sequential IDs to the POST /manage/saveFastCommand endpoint. This allows attackers to overwrite command attributes such as title, type, content, and robot binding, potentially redirecting commands to attacker-controlled URLs and reassigning commands to their own tenant.
A security flaw exists in the Email Notification Handler component of nasa-gcn (gcn.nasa.gov) up to commit b299b562af665878964b981a459f0a9c04b11adf. The vulnerability involves improper authorization due to manipulation of the Recipient argument in the /user/email file processing. The flaw can be exploited remotely. Public exploit code is available. The product uses a rolling release model, so specific affected or fixed versions are not provided. A fix has been proposed but is pending acceptance.
A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access. Upgrading to version 4.0.16 is recommended to address this issue. This patch is called d90f77314c7d4f2b53cf2425844bde2315bd26d2. Upgrading the affected component is advised.
Fluxbox versions up to 1.3.7 have an OS command injection vulnerability in the RootTheme::reconfigTheme() function. This flaw allows attackers to execute arbitrary commands by crafting style background values that include shell metacharacters. These crafted values are concatenated without proper escaping into an fbsetbg command executed via the shell when the style loads.
ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check alongside another tenant's sequential form_field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored.
Charmbracelet wish versions before 2.0.5 have a path traversal vulnerability in the git middleware component. This flaw allows authenticated SSH users to bypass directory containment checks by using crafted repository paths with relative directory references. Exploitation enables reading or writing arbitrary repositories outside the intended root directory via git-upload-pack, git-upload-archive, or git-receive-pack.
Skyvern versions through 1.0.56 have a sandbox bypass vulnerability that allows authenticated users to execute arbitrary code on the server. This is achieved by reconstructing functions from raw bytecode using types.CodeType, enabling attackers to deploy scripts that evade the is_safe_script_code AST denylist and import restricted modules such as subprocess or socket. The vulnerability has a high severity with a CVSS score of 8.8.
Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.
Usermin versions up to 2.570 have a path traversal vulnerability in the mailbox/detachall.cgi script. This flaw allows remote unauthenticated attackers to write files outside the intended temporary directory by exploiting unsanitized attachment filenames containing '../' sequences. By sending specially crafted email attachments and triggering the download of all attachments, attackers can overwrite critical files such as ~/.forward, potentially enabling command execution on the affected system.
ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts can obtain valid access tokens from the /connect/token password grant.
Usermin versions up to 2.570 have an OS command injection vulnerability in the Read Mail module. Authenticated users can exploit unsanitized IMAP folder names containing shell metacharacters to execute arbitrary commands as their system account. This bypasses webmail-only restrictions by leveraging folder deletion functionality.