php: Ability to read arbitrary files due use of external entities while parsing SOAP WSDL files

The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue in the soapxmlParseFile and...

Python tools for Pentesters

If you are involved in vulnerability research, reverse engineering or penetration testing, I suggest to try out the Python programming language. It has a rich set of useful libraries and programs. This page lists some of them. Most of the listed tools are written in Python, others are just Python...

CVE-2013-5387

Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service process crash or hang via a malformed SOAP request with a large amount of request data...

Buffer overflow

Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service process crash or hang via a malformed SOAP request with a large amount of request data...

CVE-2013-5387

Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service process crash or hang via a malformed SOAP request with a large amount of request data...

[security bulletin] HPSBMU02934 rev.1 - HP Application LifeCycle Management, GossipService SOAP Request, Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03969436 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03969436 Version: 1 HPSBMU02934 rev....

[security bulletin] HPSBMU02933 rev.1 - HP SiteScope, issueSiebelCmd SOAP Request, Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03969435 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03969435 Version: 1 HPSBMU02933 rev....

HP SiteScope code execution

Code execution via issueSiebelCmd SOAP...

CVE-2013-4835

The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765...

CVE-2013-4836

Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management ALM allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1759...

Design/Logic Flaw

Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management ALM allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1759...

Authentication flaw

The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765...

CVE-2013-4836

HP Application LifeCycle Management (ALM) Synchronizer is affected by CVE-2013-4836 due to a vulnerability in the GossipService SOAP Request feature prior to version 1.4.2, allowing remote code execution via unknown vectors. The vulnerability exists in the GossipServiceSoapBinding web service and...

CVE-2013-4836

Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management ALM allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1759...

CVE-2013-4835

The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765...

CVE-2013-4835

The vulnerability CVE-2013-4835 affects HP SiteScope’s APISiteScopeImpl SOAP service. In HP SiteScope versions 10.1x and 11.x (before 11.22), the issueSiebelCmd method allows remote attackers to bypass authentication and execute arbitrary code via a direct request. This is a remote code execution...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...

HP LoadRunner EmulationAdmin Web Service Directory Traversal

This module exploits a directory traversal vulnerability in version 11.52 of HP LoadRunner. The vulnerability exists in the EmulationAdmin web service, specifically in the copyFileToServer method, allowing the upload of arbitrary files. This module has been tested successfully on HP LoadRunner...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...