Hardcoded credentials

The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password...

CVE-2015-2903

The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password...

CVE-2015-2903

The CVE-2015-2903 issue affects HP ArcSight SmartConnectors, specifically the CWSAPI SOAP service, prior to version 7.1.6. The root cause is a hardcoded password used by the CWSAPI SOAP service, which can allow a remote attacker to obtain administrative access if the password is known. Impact des...

CVE-2014-8361

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023...

CVE-2014-8361

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023...

Design/Logic Flaw

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023...

CVE-2014-8361

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023...

CVE-2014-8361

CVE-2014-8361 affects Realtek SDK’s miniigd UPnP SOAP service. The root cause is improper input validation in the NewInternalClient handling, enabling a remote attacker to execute arbitrary code. The description notes exploitation in the wild through 2023. Related sources indicate this vulnerabil...

Routers Vulnerable to Critical Remote Code Execution Vulnerability

A zero day vulnerability in popular household routers from D-Link and Trendnet could be exploited by attackers to run arbitrary code on devices. The flaw, which can be exploited without authentication, is present in version 1.3 of Realtek’s SDK, which figures into some brands of routers, accordin...

(0Day) Realtek SDK miniigd AddPortMapping SOAP Action Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Realtek SDK. Authentication is not required to exploit this vulnerability. The specific flaw exists within the miniigd SOAP service. The issue lies in the handling of the NewInternalClient...

Multiple NetGear Routers SOAP Service Authentication Bypass Vulnerabilities

The NetGear WNDR3700v4 and NetGear WNR2500 are router devices. A security vulnerability in the SOAP service of multiple NetGear router devices allows attackers to submit specially crafted HTTP SOAP requests to bypass authentication mechanisms and obtain sensitive information...

NetGear WNDR Authentication Bypass / Information Disclosure

A number of NetGear WNDR devices contain an embedded SOAP service that is seemingly for use with the NetGear Genie application. This service allows for viewing and setting of certain router parameters. This SOAP service is prone to an authentication bypass. SPDX-FileCopyrightText: 2015 Greenbone ...

NetGear WNDR Authentication Bypass / Information Disclosure Vulnerabilities

A number of NetGear WNDR devices contain an embedded SOAP service that is seemingly for use with the NetGear Genie application. As this SOAP service is implemented by the built-in HTTP / CGI daemon, unauthenticated queries will also be answered over the internet if remote management has been...

CVE-2014-5210

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted 1 remotetask or 2 getlicense request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805...

Command injection

The 1 av-centerd SOAP service and 2 backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors...

Cross site request forgery (csrf)

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted 1 remotetask or 2 getlicense request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805...

CVE-2014-5210

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted 1 remotetask or 2 getlicense request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805...

CVE-2014-5210

CVE-2014-5210 affects the av-centerd SOAP service in AlienVault OSSIM prior to 4.7.0. The vulnerability arises from unsafe sanitization of remote_task (and get_license) SOAP requests in Util.pm, enabling remote attackers to execute arbitrary commands with root privileges. Exploitation details and...

AlienVault OSSIM av-centerd Util.pm remote_task Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the av-centerd SOAP service. The issue lies in the handling of remotetask requests du...

AlienVault OSSIM av-centerd Util.pm get_license Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the av-centerd SOAP service. The issue lies in the handling of getlicense requests du...