IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution Vulnerability

Exploit for jsp platform in category web applications Exploit Title: IBM Tivoli Service Automation Manager Remote Code Execution Date: 12\12\2014 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.ibm.com/ Version: All versions of IBM Tivoli Service Automation Manager up to 7.2.4 VU/CV...

Authentication flaw

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request...

CVE-2013-4793

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request...

CVE-2013-4793

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request...

CVE-2013-4793

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request...

PT-2014-2869

Name of the Vulnerable Software and Affected Versions Umbraco CMS versions prior to 6.0.4 Description The issue concerns the update function in the TemplateService component, which does not require authentication. This allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP...

CVE-2013-4793: Improper Authentication

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request...

CVE-2014-8553

The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...

Cross site request forgery (csrf)

The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...

CVE-2014-8553

The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...

CVE-2014-8553

The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...

CVE-2014-8553: Exposure of Sensitive Information to an Unauthorized Actor

The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...

IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution

Exploit Title: IBM Tivoli Service Automation Manager Remote Code Execution Date: 12\12\2014 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.ibm.com/ Version: All versions of IBM Tivoli Service Automation Manager up to 7.2.4 VU/CVE: VU782708, CVE-2015-0104 1. Create report 2. Browse...

Sql injection

SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request...

CVE-2014-9237

SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request...

PT-2014-8892

Name of the Vulnerable Software and Affected Versions Proticaret E-Commerce version 3.0 Description The issue allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request, specifically through "API Endpoints" that accept SOAP requests. This can lead to...

CVE-2014-9237: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request...

PT-2014-1951

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.40 Description The issue allows remote attackers to obtain sensitive information. This can be achieved via the ReadProfile parameters in the SAP Management Console. Additionally, the vulnerability exists due to a lack o...

mantisbt: sql injection

Edwin Gozeling and Wim Visser discovered that when the projectid parameter of the SOAP-request starts with the integer of a project to which the user or anonymous is authorized, the ENTIRE value will become the first item of $tprojects. As this value is concatenated in the SQL statement,...

Immunity Canvas: CITRIX_NETSCALER_SOAP

Name| citrixnetscalersoap ---|--- CVE| CVE-2014-7140 Exploit Pack| CANVAS Description| Citrix Netscaler 10.1 Soap exploit Notes| FoundBy: Console Cowboys Notes: A vulnerability exists in the SOAP handler of the web interface. A SOAP request can be crafted to trigger a memory corruption flaw,...