9721 matches found
CVE-2022-24335
JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use TOCTOU race-condition attack in agent registration via XML-RPC...
CVE-2022-24335
CVE-2022-24335 describes a TOCTOU race-condition in JetBrains TeamCity’s agent registration via XML-RPC for builds prior to 2021.2. The issue could allow an attacker to elevate privileges and impact integrity/availability; CVSSv3.1 scores show a high impact (8.1) with network access and no privil...
CVE-2022-24333
CVE-2022-24333 affects JetBrains TeamCity before 2021.2, enabling blind SSRF via an XML-RPC call. The underlying issue is an XML-RPC request handling that fails to validate identities, allowing an attacker over the network to trigger SSRF without user interaction. Impact is reported as partial co...
CVE-2022-24333
In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible...
CVE-2022-24336: Undefined Security Weakness
In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server...
CVE-2022-24335: Time-of-check Time-of-use (TOCTOU) Race Condition
JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use TOCTOU race-condition attack in agent registration via XML-RPC...
CVE-2022-24333: Server-Side Request Forgery (SSRF)
In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible...
JetBrains TeamCity code issues and vulnerabilities
JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic.JetBrains TeamCity is vulnerable to an access control error that stems from the product's failure to validate data in XML-RPC requests and the identity of the user. An attacker could...
NFS ONCRPC XDR Driver Disclosure Sensitive Information
The vulnerability of the NFS ONCRPC XDR driver for Windows operating systems is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...
CLSA-2022-1645700971 Fix of CVE: CVE-2022-23218, CVE-2022-23219
CVE-2022-23218: stack buffer overflow in sunrpc module results in DoS - CVE-2022-23219: stack buffer overflow in sunrpc module results in DoS...
A Definitive Guide to the Remote Procedure Call (RPC) Filter
...
(Pwn2Own) Cisco RV340 JSON RPC file-copy Command Injection Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Cisco RV340 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...
bitcoin-core:rpc: Use-of-uninitialized-value in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch
Project: https://github.com/bitcoin/bitcoin.git Detailed Report: https://oss-fuzz.com/testcase?key=6001319565983744 Project: bitcoin-core Fuzzing Engine: libFuzzer Fuzz Target: rpc Job Type: libfuzzermsanbitcoin-core Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...
0x-relayer-cat (>=0.0.3, <=0.0.10), @0x-klaytn/asset-swapper (>=4.2.1, <=4.2.2) +4603 more potentially affected by CVE-2022-0639 via url-parse (>=1.0.2, <=1.5.4)
url-parse NPM version =1.0.2, =0.0.3, =4.2.1, =2.1.0-beta.4, =5.0.0-beta, =0.1.0-beta.2, =0.0.1, =0.0.31, =0.0.1, =1.0.2, =0.1.0, =0.1.0, =1.6.1, =0.2.0, =1.0.3, =2.1.1 and more Source cves: CVE-2022-0639 Source advisory: GHSA-8V38-PW62-9CW2...
[SECURITY] Fedora 35 Update: protobuf-3.14.0-7.fc35
Protocol Buffers are a way of encoding structured data in an efficient yet extensible format. Google uses Protocol Buffers for almost all of its internal RPC protocols and file formats. Protocol buffers are a flexible, efficient, automated mechanism for serializing structured data...
GHSA-WHWW-V56C-CGV2 Deserialization of Untrusted Data in Apache Dubbo
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More detai...
Deserialization of Untrusted Data in Apache Dubbo
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More detai...
PT-2022-16616
Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2021.2 Description The issue allows for blind Server-Side Request Forgery SSRF via an XML-RPC call. This means an attacker could potentially force the server to make requests to arbitrary destinations, whic...
PT-2022-16618
Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2021.2 Description The issue is related to a Time-of-check/Time-of-use TOCTOU race-condition attack in agent registration via XML-RPC. This type of attack occurs when there is a delay between the time of...
Mageia: Security Advisory (MGASA-2019-0002)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...