Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2010-1632

EPSS 6.71% · P91
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2010-1632

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Axis2文档类型声明处理多个安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Axis2是一个Web服务的核心支援引擎。 根据SOAP 1.1规范的规定，SOAP消息总不能包含有文档类型声明(DTD)。在Axis2中，是通过StAXSOAPModelBuilder类来实现这个限制的。这个方法存在两个问题： 1 仅适用于SOAP绑定，而支持纯XML消息的HTTP绑定仍允许请求消息中存在DTD。 2 在处理带有DTD的文档时，StAXSOAPModelBuilder仅在从StAX解析器接收到DTD事件后才会报告错误，而这时StAX解析器可能已经处理或部分处理了DTD。 这说明Axis2
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-n/a n/a -

II. Public POCs for CVE-2010-1632

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2010-1632

请登录查看更多情报信息。

Same Patch Batch · n/a · 2010-06-22 · 16 CVEs total

CVE-2010-1407Apple iOS WebKit IFRAME元素信息泄露漏洞
CVE-2010-1751Apple iOS Application Sandbox权限许可和访问控制问题漏洞
CVE-2010-1752Apple iOS CFNewwork栈缓冲区错误漏洞
CVE-2010-1753Apple iOS ImageIO缓冲区错误漏洞
CVE-2010-1754Apple iOS Passcode Lock权限许可和访问控制问题漏洞
CVE-2010-1755Apple iOS Safari权限许可和访问控制问题漏洞
CVE-2010-1756Apple iOS 设置应用程序设计错误漏洞
CVE-2010-1757Apple iOS WebKit权限许可和访问控制问题漏洞
CVE-2010-1775Apple iOS Passcode Lock竞争条件错误漏洞
CVE-2010-2431Apple CUPS cupsFileOpen函数后置链接漏洞
CVE-2010-2432Apple CUPS 'auth.c'cupsDoAuthentication函数资源管理错误漏洞
CVE-2010-1637SquirrelMail 'mail_fetch' 远程信息泄露漏洞
CVE-2010-1638IMP 权限许可和访问控制漏洞
CVE-2010-2420Fenrir ActiveGeckoBrowser多个未明漏洞
CVE-2010-2421Opera Web 浏览器多个安全漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2010-1632

No comments yet

Leave a comment