Apache Software Foundation Axis2

CPE Details

Apache Software Foundation Axis2
apache
axis2
-
2012-10-10
14h33 +00:00
2012-11-13
22h59 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:apache:axis2:-:*:*:*:*:*:*:*

Informations

Vendor

apache

Product

axis2

Version

-

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2012-5785 2012-11-04 21h00 +00:00 Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
5.8
CVE-2012-4418 2012-10-09 21h00 +00:00 Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
5.8
CVE-2012-5351 2012-10-09 21h00 +00:00 Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
6.4
CVE-2010-1632 2010-06-22 18h24 +00:00 Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
7.5