Amazon Linux 2023 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2023-2023-068)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-068 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This...

Denial Of Service (DoS)

lava is vulnerable to Denial Of Service DoS. The vulnerability exists because the users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive memory use on the server and application crashes...

Debian: Security Advisory (DLA-569-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

U.S. Dept Of Defense: Unauthenticated Blind SSRF at https://█████ via xmlrpc.php file

An unauthenticated blind SSRF vulnerability was discovered on the xmlrpc.php file at a certain endpoint, allowing an attacker to send requests to external URLs and potentially conduct further attacks. Input validation and filtering are recommended to prevent such attacks in the future...

K37681312: PHP vulnerability CVE-2019-9020

Security Advisory Description An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpcdecode can lead to an invalid memory access heap out of bounds read or read after free. This is related to xmlelemparsebu...

K12156: PHP xmlrpc vulnerability - CVE-2010-0397

Security Advisory Description Note : For information about signing up to receive security notice updates from F5, refer to K9970: Subscribe to email notifications regarding F5 products and security announcements. Note : Versions that are not listed in this article have not been evaluated for...

SUSE CVE-2010-0397

The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpcdecoderequest function, which allows context-dependent attackers to cause a denial of service NULL pointer dereference and application crash and possibly have unspecified oth...

SUSE CVE-2013-1753

The gzipdecode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service memory consumption via a crafted HTTP request...

SUSE CVE-2014-3668

Buffer overflow in the datefromISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service application crash via 1 a crafted first argument to t...

SUSE CVE-2016-6296

Integer signedness error in the simplestringaddn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other...

SUSE CVE-2021-40323

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection...

RHEL 6 / 7 : rh-java-common-xmlrpc (RHSA-2020:0310)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0310 advisory. Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol that uses XML over HTTP to implement remote procedure calls. Security Fixe...

Debian dla-3276 : lava - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3276 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3276-1 [email protected] https://www.debian.org/lts/security/...

Debian DSA-5318-1 : lava - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5318 advisory. Igor Ponomarev discovered that LAVA, a continuous integration system for deploying operating systems onto physical and virtual hardware for running tests, was suspectible ...

XML External Entity (XXE) Injection

aXMLRPC is vulnerable to XML external entity attacks. The vulnerability exists because the library does not properly validate the XML documents submitted by the users via the parse function of ResponseParser.java, allowing an attacker to inject malicious XML documents to perform requests on behal...

PT-2023-33042 · Unknown · Xmlrpc Client

Name of the Vulnerable Software and Affected Versions: xmlrpc Client affected versions not specified Description: The issue allows an attacker to force the client to access local files or connect to undesired URLs instead of the intended target server's URL. This is possible by abusing the $metho...

spacewalk-backend spacewalk-java security update

spacewalk-backend 2.10.28-1.0.13 - Fix HTTP 500 and ORA-01830 on client scap report Orabug: 34823889 2.10.28-1.0.12 - Handle remote commands that return no output. Orabug: 32530545 2.10.28-1.0.11 - Make spacewalk-debug copy symlink target instead of the symlink itself. Orabug: 32514543...

LAVA Denial of Service Vulnerability

LAVA is a continuous integration system open sourced by LAVA. It is used to deploy operating systems to physical and virtual hardware to run tests.A denial of service vulnerability exists in versions of LAVA prior to 2022.11. The vulnerability stems from the fact that a user with valid credential...

CVE-2022-44641

In Linaro Automated Validation Architecture LAVA before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service...

CVE-2022-44641

In Linaro Automated Validation Architecture LAVA before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service...