Ricoh myPrint Hardcoded Credentials / Information Disclosure

Exploit Title: Ricoh myPrint - Hardcoded application credentials and information disclosure via WSDL webservices Google Dork: intitle:"ricoh myprint" "Copyright Ricoh. All Rights Reserved" Date: 19-11-18 Exploit Author: Hodorsec Vendor Homepage: https://www.ricoh.com Software Link:...

U.S. Dept Of Defense: SOAP WSDL Parser SQL Code Execution

Summary: SOAP WSDL Parser SQL Code Execution Description: It was possible to parse WSDL resources and read all functions from the SOAP Admin Panel, therefor i was able to repeat the sql query with a tampered request with my own custom SQL command. i was able to extract all the database names for...

Oracle WebLogic wls_utc wsdl service suffers from an xml entity injection vulnerability.

WebLogic is the United States Oracle Corporation produced a middleware based on the JAVAEE architecture , is used to develop , integrate , deploy and manage large-scale distributed Web applications , network applications and database applications of Java application servers . An xml entity...

Web Service Security Assessment Tool: WSSAT

WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it performs both static and dynamic tests again...

CVE-2017-16670

The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file...

CVE-2017-16670

The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file...

CVE-2017-16670

The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file...

Code injection

The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file...

CVE-2017-16670

The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file...

CVE-2017-16670

The CVE-2017-16670 entry concerns SoapUI 5.3.0, where the project import functionality allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file. The vulnerability affects the WSDL/project import path and can lead to code execution with high imp...

CVE-2017-16670

The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file...

CEMLink 6 Unrestricted WSDL Service Access / Poor Crypto Implementation Vulnerabilities

CEMLink 6 suffers from having unrestricted WSDL service access and a weak mechanism for password storage. Exploit Title: CEMLink6 multiple vulnerabilities Date Reported to vendor: 8/2/2017 Vendor never replied Exploit Author: email protected Vendor Homepage:...

CVE-2017-16665

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting XSS attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL...

CVE-2017-16665

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting XSS attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL...

CVE-2017-16665

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting XSS attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL...

CVE-2017-16665

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting (XSS) attack via the service parameter to the /soap URI, as described in CVE-2017-16665. The issue arises when processing a request that triggers an invalid attempt to generate WSDL, enabling injection ...

The vulnerability of the SOAP WSDL Parser module of the Microsoft .NET Framework allows a perpetrator to execute arbitrary code.

A vulnerability exists in the IsValidUrl method of the SOAP WSDL parser module of the Microsoft .NET Framework. This vulnerability arises due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary code using a...

FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY

FireEye recently detected a malicious Microsoft Office RTF document that leveraged CVE-2017-8759, a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents. FireEye analyzed a Microsoft...

Exploit for Code Injection in Microsoft

CVE-2017-8759-Exploit-sample Running CVE-2017-8759 exploit sam...

Immunity Canvas: OFFICE_WSDL

Name| officewsdl ---|--- CVE| CVE-2017-8759, CVE-2017-8570 Exploit Pack| CANVAS Description| Microsoft Office Moniker/WSDL C Injection Notes| CVE Name: CVE-2017-8759, CVE-2017-8570 VENDOR: https://office.com Notes: Send the resulting document to someone and have them open it. If the target is...