CVE-2020-9352

SmartClient 12.0 is affected by an unauthenticated blind XML External Entity (XXE) in the downloadWSDL feature. An attacker can trigger the vulnerability by sending a POST to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parameter. The issue is documented across m...

SmartClient 120 Information Disclosure / XML Injection / LFI / Code Execution

Hello, We are informing you about some vulnerabilities we found in SmartClientv120. 1. Description During an analysis on the Isomorphic Smartclient v12 LGPL version, we found multiple security flaws that are here described. The application we tested SmartClientv120p2019-06-13LGPL can be downloade...

ReadyAPI 2.5.0 / 2.6.0 - Remote Code Execution

https://twitter.com/gscamelo Vendor Homepage: https://smartbear.com/product/ready-api Software Link: https://smartbear.com/product/ready-api/overview/ Github: https://github.com/gscamelo/CVE-2018-20580 Version: 2.5.0 and 2.6.0 Tested on: Windows CVE : CVE-2018-20580 I found a new vulnerability in...

ReadyAPI 2.5.0 2.6.0 - Remote Code Execution

ReadyAPI 2.5.0 2.6.0 - Remote Code Execution https://twitter.com/gscamelo Vendor Homepage: https://smartbear.com/product/ready-api Software Link: https://smartbear.com/product/ready-api/overview/ Github: https://github.com/gscamelo/CVE-2018-20580 Version: 2.5.0 and 2.6.0 Tested on: Windows CVE :...

ReadyAPI 2.5.0 / 2.6.0 - Remote Code Execution Exploit

Exploit for multiple platform in category web applications https://twitter.com/gscamelo Vendor Homepage: https://smartbear.com/product/ready-api Software Link: https://smartbear.com/product/ready-api/overview/ Github: https://github.com/gscamelo/CVE-2018-20580 Version: 2.5.0 and 2.6.0 Tested on:...

ReadyAPI 2.5.0 / 2.6.0 Remote Code Execution

https://twitter.com/gscamelo Vendor Homepage: https://smartbear.com/product/ready-api Software Link: https://smartbear.com/product/ready-api/overview/ Github: https://github.com/gscamelo/CVE-2018-20580 Version: 2.5.0 and 2.6.0 Tested on: Windows CVE : CVE-2018-20580 I found a new vulnerability in...

CVE-2018-20580

The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file...

Code injection

The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file...

CVE-2018-20580

The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file...

CVE-2018-20580

The CVE-2018-20580 vulnerability affects SmartBear ReadyAPI 2.5.0 and 2.6.0, where WSDL import functionality can be abused to execute arbitrary Java code via a crafted parameter in a WSDL file. This is supported by multiple public references and exploits describing remote code execution. CVSSv3 b...

CIMTechniques CIMScan SQL Code Execution Vulnerability

CIMTechniques CIMScan is a critical infrastructure monitoring system from CIMTechniques, Inc. The system can be used to detect temperature, humidity and other variables in infrastructure environments.SOAP WSDL parser is one of the SOAP WSDL Web Services Description Language parsers. CIMTechniques...

Code injection

In CIMTechniques CIMScan 6.x through 6.2, the SOAP WSDL parser allows attackers to execute SQL code...

CVE-2018-16803

In CIMTechniques CIMScan 6.x through 6.2, the SOAP WSDL parser allows attackers to execute SQL code...

CVE-2018-16803

The CVE-2018-16803 entry applies to CIMTechniques CIMScan 6.x–6.2, where the SOAP WSDL parser is vulnerable to SQL code execution. Public details across connected documents corroborate a high-severity impact (NVD CVSS v3.0: 9.8, CRITICAL) with network attack vector and no user interaction require...

Hardcoded credentials

Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files...

CVE-2018-18006

Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files...

Virtuozzo 6 : java-1.7.0-openjdk / java-1.7.0-openjdk-demo / etc (VZLSA-2017-2424)

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Ricoh myPrint 2.9.2.4 - Hard-Coded Credentials

Ricoh myPrint 2.9.2.4 - Hard-Coded Credentials Exploit Title: Ricoh myPrint 2.9.2.4 - Hard-Coded Credentials Google Dork: intitle:"ricoh myprint" "Copyright Ricoh. All Rights Reserved" Date: 2018-11-19 Exploit Author: Hodorsec Vendor Homepage: https://www.ricoh.com Software Link:...

Ricoh myPrint 2.9.2.4 - Hard-Coded Credentials

Exploit Title: Ricoh myPrint 2.9.2.4 - Hard-Coded Credentials Google Dork: intitle:"ricoh myprint" "Copyright Ricoh. All Rights Reserved" Date: 2018-11-19 Exploit Author: Hodorsec Vendor Homepage: https://www.ricoh.com Software Link:...

Ricoh myPrint Hardcoded Credentials / Information Disclosure Vulnerability

Ricoh myPrint suffers from hardcoded application credential and information disclosure vulnerabilities. The myPrint windows client version 2.9.2.4 and myPrint android client version 2.2.7 are both affected. Exploit Title: Ricoh myPrint - Hardcoded application credentials and information disclosur...