7603 matches found
CVE-2014-5265
Technical details for CVE-2014-5265 are not publicly provided in the connected documents. The Initial Description mentions an XML entity expansion denial of service in IXR used by WordPress/Drupal. Monitor vendor advisories for updates.
CVE-2014-5265
The Incutio XML-RPC IXR Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted...
CVE-2014-5265
The Incutio XML-RPC IXR Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted...
WordPress <= 3.9.1 - Denial Of Service Attacks #2
The Incutio XML-RPC IXR Library permits entity declarations without considering recursion during entity expansion. In that way the attackers can cause a denial of service attacks via a crafted XML document containing a large number of nested entity references. Related records:...
WordPress <= 3.9.1 - Denial Of Service Attacks #1
The Incutio XML-RPC IXR Library, that is used in WordPress 3.9.1, does not limit the number of elements in an XML document. In that way the attackers can cause a denial of service attacks via a large document. Related records:...
Important: Red Hat Security Advisory: openstack-ceilometer security and bug fix update
Updated OpenStack Telemetry packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which give...
Drupal 6.x < 6.33 / 7.x < 7.31 XML-RPC DoS
The remote web server is running a version of Drupal that is 6.x prior to 6.33 or 7.x prior to 7.31. It is, therefore, potentially affected by multiple denial of service vulnerabilities : - The XML-RPC library in Drupal allows entity declarations without considering recursion during entity...
Microsoft Windows RPC Security Feature Bypass Vulnerability (2978668)
This host is missing an important security update according to Microsoft Bulletin MS14-047 SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
CVE-2014-0316
Memory leak in the Local RPC LRPC server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service memory consumption and bypass the ASLR protecti...
Design/Logic Flaw
Memory leak in the Local RPC LRPC server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service memory consumption and bypass the ASLR protecti...
Updated drupal packages fix security vulnerability
A denial of service issue exists in Drupal before 7.31, due to XML entity expansion in a publicly accessible XML-RPC endpoint. The drupal package has been updated to version 7.31 to fix this issue and other bugs. See the upstream advisory and release notes for more details...
WordPress 3.9.2 /xmlrpc.php 拒绝服务漏洞 poc
No description provided by source. CVE-XXXXX Wordpress and Drupal XML Blowup Attack DoS Author: Nir Goldshlager - Salesforce.com Product Security Team This is a Proof of Concept Exploit, Please use responsibly. !/usr/bin/env python from future import printfunction import threading import time...
SA-CORE-2014-004 - Drupal core - Denial of service
Drupal 6 and Drupal 7 include an XML-RPC endpoint which is publicly available xmlrpc.php. The PHP XML parser used by this XML-RPC endpoint is vulnerable to an XML entity expansion attack and other related XML payload attacks which can cause CPU and memory exhaustion and the site's database to rea...
Jetpack <= 2.9.2 - class.jetpack.php XML-RPC Access Control Bypass
The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a class.jetpack.php XML-RPC Access Control Bypass security vulnerability...
WordPress XML-RPC Interface Access Restriction Bypass
...
Wordpress XML-RPC Username/Password Login Scanner
This module attempts to authenticate against a Wordpress-site via XMLRPC using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. This module requires Metasploit: https://metasploit.com/download Current source:...
OpenVPN Access Server CSRF
XML-RPC interface CSRF...
OpenVPN Warns Customers of CSRF Bug in Access Server Desktop Client
OpenVPN is advising users of its Desktop Client to upgrade as soon as possible to avoid attacks against a CSRF vulnerability that can allow remote code execution. The vulnerability lies in a product that the company no longer supports and considers obsolete. An attacker could exploit the...
Sun Solaris <= 2.5.1 rpc.statd rpc Call Relaying Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/450/info The rpc service rpc.statd, shipped with all major versions of Sun's solaris, is the status monitoring service for NFS file locking. The vulnerability lies in rpc.statd's ability to relay rpc calls to other rpc...
AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow
No description provided by source. $Id: rpccmsdopcode21.rb 10998 2010-11-11 22:43:22Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...