CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6107
https://notcve.org/view.php?id=CVE-2012-6107
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Apache Axis2/C no verifica que el nombre del servidor coincide con un nombre de dominio en el campo del asunto Common Name (CN) o subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL a través de un certificado válido arbitrario. • http://mail-archives.apache.org/mod_mbox/axis-c-dev/201301.mbox/browser http://www.securityfocus.com/bid/57267 https://bugzilla.redhat.com/show_bug.cgi?id=894372 https://exchange.xforce.ibmcloud.com/vulnerabilities/81211 https://issues.apache.org/jira/browse/AXIS2C-1619 https://lists.apache.org/thread.html/06e82460243af2ec9cc5a9af0a718943bc53c804b0a786ac61d518e4%40%3Cc-dev.axis.apache.org%3E https://lists.apache.org/thread.html/0e30b2b72099a995f6e91342b03d3e4b477677d0ea77e3ce55b53614%40%3Cc-dev.axis.apache.org%3E https:& • CWE-310: Cryptographic Issues •
CVSS: 5.8EPSS: 0%CPEs: 9EXPL: 1CVE-2012-5785
https://notcve.org/view.php?id=CVE-2012-5785
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Apache Axis2/Java v1.6.2 y anteriores, no comprueba si el nombre del servidor coincide con un nombre de dominio en el Common Name (CN) del asunto o el campo subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL a través de un certificado válido arbitrario. • http://secunia.com/advisories/51219 http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf http://www.securityfocus.com/bid/56408 https://exchange.xforce.ibmcloud.com/vulnerabilities/79830 • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 1CVE-2012-4418
https://notcve.org/view.php?id=CVE-2012-4418
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack." Apache Axis2 permite a atacantes remotos falsificar mensajes y eludir la autenticación a través de un "ataque de envoltorio de firma XML". • http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf http://www.openwall.com/lists/oss-security/2012/09/12/1 http://www.openwall.com/lists/oss-security/2012/09/13/1 http://www.securityfocus.com/bid/55508 https://bugzilla.redhat.com/show_bug.cgi?id=856755 • CWE-287: Improper Authentication •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5351
https://notcve.org/view.php?id=CVE-2012-5351
Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418. Apache Axis2 permite a atacantes remotos falsificar mensajes y eludir la autenticación a través de una aserción SAML que carece de un elemento Signature, también conocido como un "ataque exclusión de firma", una vulnerabilidad diferente de CVE-2012-4418. • http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/79487 https://www.oracle.com/security-alerts/cpuapr2022.html • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 97%CPEs: 8EXPL: 7CVE-2010-0219 – Axis2 - (Authenticated) Code Execution (via REST)
https://notcve.org/view.php?id=CVE-2010-0219
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service. Axis2 de Apache, tal y como es usado en dswsbobje.war en SAP BusinessObjects Enterprise XI versión 3.2, CA ARCserve D2D r15 y otros productos, tiene una contraseña por defecto de axis2 para la cuenta de administrador, lo que facilita a los atacantes remotos ejecutar código arbitrario mediante la carga de un servicio web especialmente diseñado. • https://www.exploit-db.com/exploits/16312 https://www.exploit-db.com/exploits/16315 https://www.exploit-db.com/exploits/15869 https://github.com/veritas-rt/CVE-2010-0219 http://retrogod.altervista.org/9sg_ca_d2d.html http://secunia.com/advisories/41799 http://secunia.com/advisories/42763 http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf http://www.exploit-db.com/exploits/15869 http://www.kb.cert.org/vuls/id/989719 http://www.osvd • CWE-255: Credentials Management Errors •