The vulnerability of the iControl SOAP interface for access control and remote authentication in BIG-IP and server software, BIG-IQ Centralized Management, allows a perpetrator to execute arbitrary commands with elevated privileges.

The vulnerability of the iControl SOAP interface for access control and remote authentication in BIG-IP and server software, BIG-IQ Centralized Management, is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

SUSE SLES12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2022:4068-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4068-1 advisory. - Version update to 7.4.33: - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont...

Apache SOAP authentication error vulnerability

Apache SOAP is used as a client-side library by the Apache Foundation to invoke SOAP services available elsewhere, and as a server-side tool to implement SOAP-accessible services. an authentication error vulnerability exists in Apache SOAP, which stems from the fact that RPCRouterServlet can be...

F5 Networks BIG-IP : iControl SOAP vulnerability (K94221585)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5.3 / 15.1.8.1 / 16.1.3.3 / 17.0.0.2 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K94221585 advisory. BIG-IP and BIG-IQ are vulnerable to cross-site request forgery CSRF attacks through...

PT-2022-5572 · F5 · Big-Iq Centralized Management +1

Name of the Vulnerable Software and Affected Versions: BIG-IP and BIG-IQ Centralized Management affected versions not specified Description: The issue is related to a cross-site request forgery CSRF attack through the iControl SOAP interface, which can allow a remote attacker to execute arbitrary...

F5 BIG-IP iControl CSRF File Write SOAP API

This module exploits a cross-site request forgery CSRF vulnerability in F5 Big-IP's iControl interface to write an arbitrary file to the filesystem. While any file can be written to any location as root, the exploitability is limited by SELinux; the vast majority of writable locations are...

GHSA-789V-H9HW-38PG Apache SOAP contains unauthenticated RPCRouterServlet

UNSUPPORTED WHEN ASSIGNED In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might...

Apache SOAP contains unauthenticated RPCRouterServlet

UNSUPPORTED WHEN ASSIGNED In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might...

CVE-2022-45378

In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary...

CVE-2022-45378

In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary...

Remote code execution

UNSUPPPORTED WHEN ASSIGNED In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this migh...

CVE-2022-45378 Apache SOAP allows unauthenticated users to potentially invoke arbitrary code

In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary...

CVE-2022-45378 Apache SOAP allows unauthenticated users to potentially invoke arbitrary code

In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary...

CVE-2022-45378

Oracle WebCenter Portal versions affected include 12.2.1.4.0, where the Portal Core component (Apache SOAP) is vulnerable due to a default unauthenticated RPCRouterServlet. This could allow an attacker to invoke methods on classpath entries and, depending on available classes, may lead to arbitra...

Apache SOAP 访问控制错误漏洞

Apache SOAP is used as a client-side library by the Apache Foundation to invoke SOAP services available elsewhere, and as a server-side tool to implement SOAP-accessible services. an authentication error vulnerability exists in Apache SOAP, which stems from the fact that RPCRouterServlet can be...

Information Disclosure

soap is vulnerable to information disclosure. The vulnerability exists due to the lack of restrictions in the XML external entity reference of the library, allowing an attacker to read arbitrary files over HTTP...

PT-2022-6983 · D Link · D-Link Dap-1325

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1325 affected versions not specified Description: The issue is related to a buffer overflow in the SetAPLanSettings function of the D-Link DAP-1325 wireless signal amplifier's firmware when processing XML data. This can allow a...

PT-2022-6977 · D Link · D-Link Dap-1325

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1325 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this issue. Th...

PT-2022-6960 · D Link · D-Link Dap-1325

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1325 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this issue. Th...

Apache SOAP XML External Entity Injection Vulnerability

Apache SOAP is used as a client-side library by the Apache Foundation to invoke SOAP services available elsewhere, and as a server-side tool to implement SOAP-accessible services. parser in the RPCRouterServlet. An attacker could exploit this vulnerability to read arbitrary files...