4028 matches found
chillybsoapcompany.co.uk XSS vulnerability
Vulnerable URL: http://www.chillybsoapcompany.co.uk/search-results.html?sitesearchresults1=%3C/script%3E%3Cscript%3Ealert%28%27XSSPOSED%27%29%3C/script%3E=0 Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 21:37 GMT Vulnerability type:| XSS...
CVE-2015-6029
HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach...
CVE-2015-2903
The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password...
Hardcoded credentials
The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password...
Design/Logic Flaw
HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach...
CVE-2015-2903
The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password...
CVE-2015-2903
The CVE-2015-2903 issue affects HP ArcSight SmartConnectors, specifically the CWSAPI SOAP service, prior to version 7.1.6. The root cause is a hardcoded password used by the CWSAPI SOAP service, which can allow a remote attacker to obtain administrative access if the password is known. Impact des...
CVE-2015-6029
HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach...
CVE-2013-1824
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue in the soapxmlParseFile and...
CVE-2007-1889
Integer signedness error in the zendmmallocint function in the Zend Memory Manager in PHP 5.2.0 allows remote attackers to execute arbitrary code via a large emalloc request, related to an incorrect signed long cast, as demonstrated via the HTTP SOAP client in PHP, and via a call to msgreceive wi...
eBay Magento <= 1.9.2.1 - PHP FPM XML eXternal Entity Injection Vulnerability
Exploit for php platform in category web applications ============================================= - Release date: 29.10.2015 - Discovered by: Dawid Golunski - Severity: High/Critical - eBay Magento ref.: APPSEC-1045 ============================================= I. VULNERABILITY...
eBay Magento XXE Injection
============================================= - Release date: 29.10.2015 - Discovered by: Dawid Golunski - Severity: High/Critical - eBay Magento ref.: APPSEC-1045 ============================================= I. VULNERABILITY ------------------------- eBay Magento CE = 1.9.2.1 XML eXternal Entit...
eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection
============================================= - Release date: 29.10.2015 - Discovered by: Dawid Golunski - Severity: High/Critical - eBay Magento ref.: APPSEC-1045 ============================================= I. VULNERABILITY ------------------------- eBay Magento CE = 1.9.2.1 XML eXternal Entit...
eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection
eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection ============================================= - Release date: 29.10.2015 - Discovered by: Dawid Golunski - Severity: High/Critical - eBay Magento ref.: APPSEC-1045 ============================================= I. VULNERABILITY...
SUSE SLES11 Security Update : php53 (SUSE-SU-2015:1818-1)
This update of PHP5 brings several security fixes. Security fixes : - CVE-2015-6831: A use after free vulnerability in unserialize has been fixed which could be used to crash php or potentially execute code. bnc942291 bnc942294 bnc942295 - CVE-2015-6836: A SOAP serializefunctioncall type confusio...
[KIS-2015-04] Magento <= 1.9.2 (catalogProductCreate) Autoloaded File Inclusion Vulnerability
------------------------------------------------------------------------------- Magento = 1.9.2 catalogProductCreate Autoloaded File Inclusion Vulnerability ------------------------------------------------------------------------------- - Software Link: http://magento.com/ - Affected Versions:...
Beckhoff CX9020 CPU Module - Remote Code Execution
!/usr/bin/env python ''' Exploit Title: Beckhoff CX9020 CPU Module Web Exploit RCE Date: 2015-10-22 Exploit Author: Photubias - tijldotdeneutathowestdotbe, based on work by Frank Lycops [email protected] Vendor Homepage: https://www.beckhoff.com/english.asp?embeddedpc/cx9020.htm...
HP ArcSight Logger contains multiple vulnerabilities
Overview HP ArcSight Logger contains multiple vulnerabilities, allowing authentication bypass and privilege escalation in certain scenarios. Description CWE-285: Improper Authorization- CVE-2015-2136A remote authenticated user without Logger Search permissions may be able to bypass authorization...
D-link DIR-890L HNAP 未授权信息泄漏漏洞
HNAPHome Network Administration Protocol,家庭网络管理协议是一种基于SOAPSimple Object Access Protocol,简单对象管理协议的协议，和UPnP很像，通常被D-Link的”EZ”设置程序用来初始化设置路由器。 存在问题代码： / Grab a pointer to the SOAPAction header / SOAPAction = getenv"HTTPSOAPACTION"; / Skip authentication if the SOAPAction header contains...
Oracle Endeca IDI ETL Server DownloadFileContent Directory Traversal (CVE-2015-4745)
A directory traversal vulnerability exists in Oracle Endeca Information Discovery Integrator ETL Server. The vulnerability is due to insufficient input validation while processing SOAP requests to the DownloadFileConent operation. A remote authenticated attacker can leverage this vulnerability to...