CVSS: 7.4EPSS: 0%CPEs: 7EXPL: 0CVE-2018-11775 – activemq: ActiveMQ Client Missing TLS Hostname Verification
https://notcve.org/view.php?id=CVE-2018-11775
10 Sep 2018 — TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default. Falta la verificación de nombres de host TLS al emplear Apache ActiveMQ Client en versiones anteriores a la 5.15.6, lo que podría hacer que el cliente sea vulnerable a un ataque Man-in-the-Middle (MitM) entre una aplicación Java que emplea el cliente Activ... • http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 6%CPEs: 51EXPL: 0CVE-2018-11040
https://notcve.org/view.php?id=CVE-2018-11040
25 Jun 2018 — Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "... • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 6.5EPSS: 0%CPEs: 71EXPL: 0CVE-2018-1257 – spring-framework: ReDoS Attack with spring-messaging
https://notcve.org/view.php?id=CVE-2018-1257
11 May 2018 — Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack. Spring Framework, en versiones 5.0.x anteriores a la 5.0.6, versiones 4.3.x anteriores a la 4.3.17 y versiones antiguas no soportadas,... • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10005
https://notcve.org/view.php?id=CVE-2017-10005
08 Aug 2017 — Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may ... • http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10006
https://notcve.org/view.php?id=CVE-2017-10006
08 Aug 2017 — Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Private Banki... • http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10007
https://notcve.org/view.php?id=CVE-2017-10007
08 Aug 2017 — Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score... • http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10008
https://notcve.org/view.php?id=CVE-2017-10008
08 Aug 2017 — Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score... • http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10009
https://notcve.org/view.php?id=CVE-2017-10009
08 Aug 2017 — Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data. CVS... • http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html •
CVSS: 4.9EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10010
https://notcve.org/view.php?id=CVE-2017-10010
08 Aug 2017 — Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: FileUploads). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, inser... • http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10011
https://notcve.org/view.php?id=CVE-2017-10011
08 Aug 2017 — Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle FLEXCUBE Private Banking executes to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access t... • http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html •