https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:00:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-115544 EUVD-2026-115544 https://cve.radiocsirt.org/vuln/euvd-2026-115544 https://cve.radiocsirt.org/vuln/fkie_cve-2011-2487 <p>The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.</p> <p>The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2011-2487 https://cve.radiocsirt.org/vuln/ghsa-4qqf-hmv6-r6wh <p><strong>Affected:</strong> Maven: org.apache.ws.security:wss4j, Maven: wss4j:wss4j</p> <p>The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.</p> <p><strong>Affected:</strong> Maven: org.apache.ws.security:wss4j, Maven: wss4j:wss4j</p> <p>The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.</p> https://cve.radiocsirt.org/vuln/ghsa-4qqf-hmv6-r6wh https://cve.radiocsirt.org/vuln/gsd-2011-2487 gsd-2011-2487 https://cve.radiocsirt.org/vuln/gsd-2011-2487 https://cve.radiocsirt.org/vuln/rhsa-2013:0191 <p>JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing jbossws: Prone to character encoding pattern attack (XML Encryption flaw) jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure CSRF on jmx-console allows invocation of operations on mbeans Console: XSS in invoke operation Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs JBoss invoker servlets do not require authentication JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided Web: Bypass of security constraints JBoss: AuthorizationInterceptor allows JMX operation to proceed despite authorization failure</p> <p>JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing jbossws: Prone to character encoding pattern attack (XML Encryption flaw) jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure CSRF on jmx-console allows invocation of operations on mbeans Console: XSS in invoke operation Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs JBoss invoker servlets do not require authentication JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided Web: Bypass of security constraints JBoss: AuthorizationInterceptor allows JMX operation to proceed despite authorization failure</p> https://cve.radiocsirt.org/vuln/rhsa-2013:0191