16 February 2017

3 results · Clear filters · Feed

• Medium 4.9
  CVE-2016-4314 Public exploit EPSS 12%

  WSO2 Carbon directory traversal vulnerability

  Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.

  org.wso2.carbon.commons:org.wso2.carbon.logging.view.ui Maven
  Feb 16, 2017
• Medium 6.1
  CVE-2016-4316 Public exploit

  WSO2 Carbon vulnerable to Cross-site Scripting

  Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-lis…

  org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui Maven
  Feb 16, 2017
• Medium 6.3
  CVE-2016-9955

  Incorrect signature verification in SimpleSAMLphp

  The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values t…

  simplesamlphp simplesamlphp simplesamlphp/simplesamlphp Debian Ubuntu Packagist
  Feb 16, 2017