Genivia gSOAP 输入验证错误漏洞

Genivia gSOAP is a C/C++ software development toolkit with automatic coding capabilities from Genivia, USA. A security vulnerability exists in Genivia gSOAP version 2.8.107, which stems from an exception in the handling of user input by the program, and can be exploited by an attacker to cause...

CVE-2021-26295

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. Recent assessments: zeroSteiner at March 31, 2021 1:24pm UTC reported: This vulnerability is pretty straightforward to exploit. It is due to an...

Apache OFBiz SOAP Java Deserialization

This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated SOAP endpoint /webtools/control/SOAPService for versions prior to 17.12.06. Module Options msf use exploit/linux/http/apache/ofbizdeserializationsoap msf undefinedofbizdeserializationsoap show actions...

[SECURITY] Fedora 34 Update: gsoap-2.8.104-4.fc34

The gSOAP Web services development toolkit offers an XML to C/C++ language binding to ease the development of SOAP/XML Web services in C and C/C++...

Fedora 33 : gsoap (2021-faea36a9c3)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-faea36a9c3 advisory. - A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can le...

D-Link DIR-3060 授权RCE漏洞（CVE-2021-28144）

Advisory: D-Link DIR-3060 Authenticated RCE CVE-2021-28144 MARCH 11, 2021 Overview The D-Link DIR-3060 running firmware versions below v1.11b04 is affected by a post-authentication command injection vulnerability. Anybody with authenticated access to a DIR-3060 would be able to run arbitrary syst...

Denial Of Service (DoS)

gsoap:sid is vulnerable to a denial-of-service. The vulnerability exists in the WS-Addressing plugin functionality when an attacker sends specially crafted SOAP request...

Denial Of Service (DoS)

gsoap is vulnerable to denial-of-service. The WS-Security plugin functionality allows an attacker to crash the application using a malicious SOAP request...

Denial Of Service (DoS)

gsoap is vulnerable to denial of service DoS. The vulnerability exists in the WS-Security plugin functionality when processing a SOAP request...

Denial Of Service (DoS)

gsoap:sid is vulnerable to a denial-of-service vulnerability. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability...

Remote Code Execution

gsoap is vulnerable to remote code execution. The WS-Addressing plugin functionality allows an attacker to execute arbitrary code on the host OS using a malicious SOAP request...

Genivia gSOAP Null Pointer Dereference Vulnerability

gSOAP is a C/C++ library for developing XML-based Web services . A null pointer dereference vulnerability exists in the WS-Security plug-in feature of Genivia gSOAP 2.8.107. An attacker could exploit this vulnerability by sending a specially crafted SOAP request to cause a denial of service...

Ruby: Round-trip instability in REXML

Submitted previously via email to [email protected] due to REXML not being listed under in-scope assets here. Explicitly requested by @hsbt to re-submit through HackerOne. CVSS rating calculated based on confirmed downstream impact. --- Hi Ruby Security Team, I'm reaching out to you to repor...

CVE-2021-21702

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash...

CVE-2021-21702

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash...

DEBIAN-CVE-2021-21702

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash...

CVE-2021-21702

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash...

UBUNTU-CVE-2021-21702

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash...

Null pointer dereference

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash...

CVE-2021-21702

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash...