what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 5 of 5 RSS Feed

Files from Colm O hEigeartaigh

Email addresscoheigea at apache.org
First Active2012-02-07
Last Active2013-12-20
Java XML Signature Denial Of Service Attack
Posted Dec 20, 2013
Authored by Colm O hEigeartaigh

The Apache Santuario XML Security for Java project is vulnerable to a Denial of Service (DoS) type attack leading to an OutOfMemoryError, which is caused by allowing Document Type Definitions (DTDs) when applying Transforms. From the 1.5.6 release onwards, DTDs will not be processed at all when the "secure validation" mode is enabled.

tags | advisory, java, denial of service
advisories | CVE-2013-4517
SHA-256 | 8718e8b28ba92f0c8d1021a89a00f91b0c89c346b43d6b5dba5031eb339cb16c
Apache CXF SOAP Action Spoofing Attacks
Posted Sep 20, 2012
Authored by Colm O hEigeartaigh | Site cxf.apache.org

Apache CXF is vulnerable to SOAP Action spoofing attacks on Document Literal web services.

tags | advisory, web, spoof
advisories | CVE-2012-3451
SHA-256 | 265093c0400de4893cfcfb8c5d295612e2d9b4b4da83727f2ebd03463249a7fa
Apache CXF Failed Element Verification
Posted Jun 8, 2012
Authored by Colm O hEigeartaigh | Site cxf.apache.org

Apache CXF does not verify that elements were signed or encrypted by a particular Supporting Token. This affects all released versions as of 06/08/2012.

tags | advisory
advisories | CVE-2012-2379
SHA-256 | c9c7fa7be43cf530477727dcae683b3b6071776b83dccb3e1ab0dc315ec3a472
Apache CXF Failed Pickup Of Child Policies
Posted Jun 8, 2012
Authored by Colm O hEigeartaigh | Site cxf.apache.org

Apache CXF does not pick up some child policies of WS-SecurityPolicy 1.1 SupportingToken policy assertions on the client side. Apache CXF versions 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.0 are affected.

tags | advisory
advisories | CVE-2012-2378
SHA-256 | 9192946a363a63b454cdbfe47e3d089546ef6e6058eec8ac012d7080b7e47be8
Apache CXF UsernameToken Broken Validation
Posted Feb 7, 2012
Authored by Colm O hEigeartaigh | Site cxf.apache.org

Apache CXF versions 2.4.5 and 2.5.1 fail to validate a WS-Security UsernameToken received as part of the security header of a SOAP request against a WS-SP UsernameToken policy.

tags | advisory
advisories | CVE-2012-0803
SHA-256 | b292e2def6610f71ed845303fc918ae45534205d8f616f67a68c79fe20ca97ba
Page 1 of 1
Back1Next

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    27 Files
  • 28
    Sep 28th
    8 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close