CVE-2013-4835

The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765...

PT-2013-5234

Name of the Vulnerable Software and Affected Versions HP Application LifeCycle Management versions prior to 1.4.2 Description The issue allows remote attackers to execute arbitrary code via unknown vectors. This is related to an unspecified vulnerability in the GossipService SOAP Request...

CVE-2013-4836: Undefined Security Weakness

Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management ALM allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1759...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...

HP LoadRunner EmulationAdmin Web Service Directory Traversal

This module exploits a directory traversal vulnerability in version 11.52 of HP LoadRunner. The vulnerability exists in the EmulationAdmin web service, specifically in the copyFileToServer method, allowing the upload of arbitrary files. This module has been tested successfully on HP LoadRunner...

USN-2008-1: Suds vulnerability

Ralph Loader discovered that Suds incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files. In the default installation of Ubuntu, this should be prevented by the Yama link restrictions...

CVE-2013-3244

Multiple unspecified vulnerabilities in the CJDBFILLMEMORYFROMPPB function in the Project System PS-IS module for SAP ERP Central Component ECC allow remote attackers to execute arbitrary code via a 1 RFC or 2 SOAP-RFC request...

Cross site request forgery (csrf)

Multiple unspecified vulnerabilities in the CJDBFILLMEMORYFROMPPB function in the Project System PS-IS module for SAP ERP Central Component ECC allow remote attackers to execute arbitrary code via a 1 RFC or 2 SOAP-RFC request...

CVE-2013-3244

Multiple unspecified vulnerabilities in the CJDBFILLMEMORYFROMPPB function in the Project System PS-IS module for SAP ERP Central Component ECC allow remote attackers to execute arbitrary code via a 1 RFC or 2 SOAP-RFC request...

PT-2013-4250

Name of the Vulnerable Software and Affected Versions SAP ERP Central Component ECC affected versions not specified Description The issue is related to multiple unspecified vulnerabilities in the CJDB FILL MEMORY FROM PPB function within the Project System PS-IS module. These vulnerabilities allo...

CVE-2013-3244: Improper Control of Generation of Code

Multiple unspecified vulnerabilities in the CJDBFILLMEMORYFROMPPB function in the Project System PS-IS module for SAP ERP Central Component ECC allow remote attackers to execute arbitrary code via a 1 RFC or 2 SOAP-RFC request...

OpenJDK: unprivileged proxy settings change via SOAPConnection (SAAJ, 7013971)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 26 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to SAAJ...

Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20130930)

It was found that PHP did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. CVE-2006-7243 It was found that PHP did not check for carriage returns i...

php53 security update

CentOS Errata and Security Advisory CESA-2013:1307 Updated php53 packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common...

Oracle Linux 5 : php53 (ELSA-2013-1307)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1307 advisory. - add security fix for CVE-2013-4248 - add security fix for CVE-2013-4113 - add security fixes for CVE-2006-7243 - add security fixes for CVE-2012-2688...

Jira is logging SOAP body in default config - passwords included

In the default log4j.properties of Jira, there are settings for logging soap dumps. The config file does not explicitly enable the logging of soap dumps, but somehow, this happens, with usernames and passwords. For security, this should be fixed or removed from log4j config...

Jira is logging SOAP body in default config - passwords included

In the default log4j.properties of Jira, there are settings for logging soap dumps. The config file does not explicitly enable the logging of soap dumps, but somehow, this happens, with usernames and passwords. For security, this should be fixed or removed from log4j config...