SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution Exploit

Exploit for windows platform in category remote exploits !/usr/bin/env python import argparse import urllib import requests, random from bs4 import BeautifulSoup from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning...

SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution

SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution !/usr/bin/env python import argparse import urllib import requests, random from bs4 import BeautifulSoup from requests.packages.urllib3.exceptions import InsecureRequestWarning...

CVE-2018-2380

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs...

CVE-2018-2380

CVE-2018-2380 affects SAP CRM running on SAP NetWeaver (CRM versions 7.01, 7.02, 7.30, 7.31, 7.33, 7.54). The issue is a directory traversal vulnerability caused by insufficient validation of user-supplied path information, allowing traversal sequences to be passed to file APIs. Remediation is av...

CVE-2018-2380

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs...

Pidgin MXIT mxit_convert_markup_tx Information Leak Vulnerability(CVE-2016-2380)

DESCRIPTION An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out of bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead...

CVE-2017-2380

CVE-2017-2380 affects iOS before 10.3 in the SCEP implementation within the Profiles component. The issue allows remote attackers to bypass cryptographic protections by leveraging DES support, enabling cryptographic protection circumvention via SCEP. Apple’s iOS 10.3 release addresses this by dep...

CVE-2016-2380

CVE-2016-2380 affects Pidgin via an information leak in MXIT protocol handling. Specially crafted MXIT data could trigger an out-of-bounds read when a user enters a string that is mis-converted, per multiple connected advisories (e.g., Nessus/Red Hat EulerOS entries). The vulnerability is limited...

[SECURITY] [DSA 3620-1] pidgin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3620-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 15, 2016 https://www.debian.org/security/faq -...

KLA10932 Multiple vulnerabilities in Pidgin

Multiple serious vulnerabilities have been found in Pidgin. Malicious users can exploit these vulnerabilities to overwrite arbitrary files, cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A directory traversal vulnerability in the handling of...

CVE-2015-2380

CVE-2015-2380 affects Microsoft Office/Word components (Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1) and is caused by memory corruption in how Office handles objects in memory when parsing crafted documents, enabling remote code execution or memory corruption. C...

Microsoft Office Memory Corruption (MS15-070: CVE-2015-2380)

A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...

MS15-070: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3072620)

The remote Windows host has a version of Microsoft Office, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, SharePoint Server, or Microsoft Office Compatibility Pack installed that is affected by multiple vulnerabilities : - An ASLR bypass vulnerability exists in Microsoft Excel due to memo...

Ubuntu 14.04 LTS : Bash vulnerabilities (USN-2380-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2380-1 advisory. Michal Zalewski discovered that Bash incorrectly handled parsing certain function definitions. If an attacker were able to create an environment variable...

Ubuntu: Security Advisory (USN-2380-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-2380

Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file...

CVE-2014-2380

Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1–5.5 is affected by Inadequate Encryption Strength (CWE-326). The vulnerability arises from weak encryption of credential data, enabling remote attackers to read a credential file and obtain sensitive information. Some sources a...

Schneider Electric Wonderware Vulnerabilities

OVERVIEW Timur Yunusov, Ilya Karpov, Sergey Gordeychik, Alexey Osipov, and Dmitry Serebryannikov of the Positive Technologies Research Team have identified four vulnerabilities in the Schneider Electric Wonderware Information Server WIS. Schneider Electric has produced an update that mitigates...

CVE-2013-2380

Technical details for CVE-2013-2380 are not provided in the supplied connected documents. No product/version specifics or remediation are included here; monitor official advisories for updates and confirmation of applicability.

CVE-2012-2380

CVE-2012-2380 affects the Apache Roller project, specifically the admin/editor console. The issue is that HTTP POST interfaces in the Roller admin/editor console were not protected against CSRF, allowing remote attackers to hijack admin/editor authentication. Affected versions include Roller 4.0....