3184 matches found
CVE-2015-0518
The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies group permissions...
CVE-2015-0518
EMC Documentum D2 (D2FS web service Properties component) is affected by CVE-2015-0518. A flaw in the D2FS Properties service allows a remote authenticated, low-privilege D2 user to modify group permissions and escalate to superuser privileges. Affected products/versions include D2 3.1 through SP...
EMC Documentum D2 < 4.1 P22 / 4.2 P11 Multiple Vulnerabilities (ESA-2015-010)
The remote host is running a version EMC Documentum D2 prior to 4.1 P22 / 4.2 P11. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to the D2-API component logging the MD5 hash of the passphrase used to encrypt sensitive information and...
OpenJDK: insufficient code privileges checks (JAX-WS, 8054367)
An improper permission check issue was discovered in the JAX-WS component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions...
Marriott Fixes Simple Bug in Web Service That Could Explose Customer Data
Customer payment information and other data was made vulnerable by a flaw in the Marriott Web service used by the Android app as well as the Web site, a security researcher found. The vulnerability is the result of Marriott’s system failing to use any kind of authentication on requests, meaning...
Vaadin Framework Detection (HTTP)
HTTP based detection of Vaadin Framework. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...
OpenJDK: insufficient code privileges checks (JAX-WS, 8054367)
An improper permission check issue was discovered in the JAX-WS component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions...
Red Hat CloudForms Management Engine SQL Injection Vulnerability
Red Hat CloudForms is hybrid cloud management software from Red Hat. A SQL injection vulnerability in Red Hat CloudForms Management Engine allows attackers to send specially crafted REST API requests to manipulate or obtain database data...
Multiple Buffer Overflow Vulnerabilities in VDG Security SENSE
VDG Security SENSE is a video management system. Multiple buffer overflow vulnerabilities in the VDG Security SENSE DIVA web service API allow remote attackers to submit a special AuthenticateUser request to execute arbitrary code via the user or password parameters...
CVE-2014-9451
Multiple stack-based buffer overflows in the DIVA web service API /webservice in VDG Security SENSE formerly DIVA 2.3.13 allow remote attackers to execute arbitrary code via the 1 user or 2 password parameter in an AuthenticateUser request...
CVE-2014-9451
Multiple stack-based buffer overflows in the DIVA web service API /webservice in VDG Security SENSE formerly DIVA 2.3.13 allow remote attackers to execute arbitrary code via the 1 user or 2 password parameter in an AuthenticateUser request...
Vulnerabilities in Samsung SyncThru Web Service
Hello 3APA3A! There are Information Leakage and Insufficient Authorization vulnerabilities in SyncThru Web Service. This is web application for Samsung printers, particularly I found it with Samsung ML-1865W and other printers. Earlier I informed Samsung about it. ------------------------- Affect...
Samsung SyncThru Web Service unauthenticated access
User's account is not checked...
CVE-2014-7831
lib/classes/gradesexternal.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the getgrades web service...
CVE-2014-7831
lib/classes/gradesexternal.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the getgrades web service...
CVE-2014-7834
CVE-2014-7834 – Moodle : Affected: Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3. Component: mod/forum/externallib.php. Issue: does not verify group permissions when using the forum_get_discussions web service. Root cause: missing verification of group permissions in the forum web service call...
Updated moodle package fixes security vulnerabilities
In Moodle before 2.6.5, without forcing encoding, it was possible that UTF7 characters could be used to force cross-site scripts to AJAX scripts although this is unlikely on modern browsers and on most Moodle pages MSA-14-0035. In Moodle before 2.6.5, an XSS issue through $searchcourse in...
Visual Mining NetCharts Server Remote Code Execution Exploit
This Metasploit module exploits multiple vulnerabilities in Visual Mining NetCharts. First, a lack of input validation in the administration console permits arbitrary jsp code upload to locations accessible later through the web service. Authentication is typically required, however a 'hidden' us...