57 matches found
Authentication flaw
A vulnerability in the Simple Object Access Protocol SOAP of Cisco TelePresence Management Suite TMS software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to a lack of proper access and authentication controls on the...
The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to trigger a service failure.
The vulnerability of the Core component of the Oracle VM VirtualBox software is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to trigger a service failure using the SOAP protocol...
Oracle VM VirtualBox 5.2.x < 5.2.24 / 6.0.x < 6.0.2 (Jan 2019 CPU)
The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.24 or 6.0.x prior to 6.0.2. It is, therefore, affected by multiple vulnerabilities as noted in the January 2018 Critical Patch Update advisory : - A denial of service vulnerability in the bundled third-party...
The vulnerability of the IBM WebSphere Application Server application server lies in its ability to restore unreliable data structures in memory, allowing an attacker to execute arbitrary code.
The vulnerability of the IBM WebSphere Application Server application server lies in the recovery of unreliable data structures in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary Java code using a SOAP connection, from a remote location...
[SECURITY] Fedora 27 Update: axis-1.4-35.fc27
Apache AXIS is an implementation of the SOAP "Simple Object Access Protoco l" submission to W3C. From the draft W3C specification: SOAP is a lightweight protocol for exchange of information in a decentraliz ed, distributed environment. It is an XML based protocol that consists of three parts: an...
Devil's Ivy vulnerability(CVE-2017-9765)
When we began a security analysis of remote configuration services last year, we had no idea it would lead us to uncover vulnerabilities that affect so many users. We have been studying the prevalence and nature of the vulnerabilities that arise in remote configuration services, so when we...
Schneider Electric U.motion Builder SOAP Remote Code Execution Vulnerability
U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in the Schneider Electric U.motion Builder SOAP. The system allows SOAP requests to execute arbitrary SQL commands. An attacker could exploit the vulnerability to execute arbitrary...
D-Link DIR-Series Routers - HNAP Login Stack Buffer Overflow (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' Payload working status: MIPS: - all valid payloads working the ones that we are able to send without null bytes ARM: - inline rev/bind shell works...
DLink DIR Routers HNAP Login Stack Buffer Overflow Vulnerability
A stack buffer overflow affects several D-Link routers and can be exploited by an unauthenticated attacker. The interesting thing about this vulnerability is that it affects both ARM and MIPS devices, so exploitation is slightly different for each type. A stack bof in several Dlink routers, which...
Dlink DIR Routers Unauthenticated HNAP Login Stack Buffer Overflow
Several Dlink routers contain a pre-authentication stack buffer overflow vulnerability, which is exposed on the LAN interface on port 80. This vulnerability affects the HNAP SOAP protocol, which accepts arbitrarily long strings into certain XML parameters and then copies them into the stack. This...
dotDefender Firewall 5.00.12865 / 5.13-13282 - Cross-Site Request Forgery
Exploit for php platform in category web applications + Credits: hyp3rlinx Vendor: ================== www.applicure.com Product: ===================== dotDefender Firewall Versions: 5.00.12865 / 5.13-13282 dotDefender is a Web application firewall WAF for preventing hacking attacks like XSS, SQL...
WhatsUp Gold 16.3 Remote Code Execution
Exploit Title: WhatsUp Gold v16.3 Unauthenticated Remote Code Execution Date: 2016-01-13 Exploit Author: Matt Buzanowski Vendor Homepage: http://www.ipswitch.com/ Version: 16.3.x Tested on: Windows 7 x86 CVE : CVE-2015-8261 Usage: python DroneDeleteOldMeasurements.py import requests import sys...
Google AdWords API PHP Client Library 6.2.0 XXE Injection Vulnerability
Google AdWords API PHP client library versions 6.2.0 and below suffer from an XML eXternal Entity injection vulnerability. ============================================= - Release date: 06.11.2015 - Discovered by: Dawid Golunski - Severity: Medium/High =============================================...
CVE-2013-3213
CVE-2013-3213 affects vtiger CRM 5.0.0–5.4.0, exposing multiple SQL injection vectors via SOAP services. Vulnerable code paths include get_picklists in /soap/customerportal.php, get_tickets_list in /soap/customerportal.php, and SearchContactsByEmail in /soap/thunderbirdplugin.php and /soap/vtiger...
Fedora Update for axis FEDORA-2013-1222
Check for the Version of axis OpenVAS Vulnerability Test Fedora Update for axis FEDORA-2013-1222 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...
[SECURITY] Fedora 17 Update: axis-1.4-19.fc17
Apache AXIS is an implementation of the SOAP "Simple Object Access Protoco l" submission to W3C. From the draft W3C specification: SOAP is a lightweight protocol for exchange of information in a decentraliz ed, distributed environment. It is an XML based protocol that consists of three parts: an...