(0Day) SAP Sybase ESP esp_parse Connection.getErrors Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.getErrors function in espserverlib.dll. By sending specific arguments ...

(0Day) SAP Sybase ESP esp_parse Connection.setParams Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.setParams function in espserverlib.dll. By sending specific arguments ...

(0Day) SAP Sybase ESP esp_parse Connection.reset Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.reset function in espserverlib.dll. By sending specific arguments to t...

(0Day) SAP Sybase ESP esp_parse ConnectionType.getXmlDescription Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the ConnectionType.getXmlDescription function in espparse.exe. By sending specific...

(0Day) SAP Sybase ESP esp_parse Connection.setScanDepth Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.setScanDepth function in espserverlib.dll. By sending specific argumen...

(0Day) SAP Sybase ESP esp_parse Connection.dispose Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.dispose function in espserverlib.dll. By sending specific arguments to...

(0Day) SAP Sybase ESP esp_parse Connection.canDiscover Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.canDiscover function in espserverlib.dll. By sending specific argument...

(0Day) SAP Sybase ESP esp_parse ConnectionType.getParamNames Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the ConnectionType.getParamNames function in espserverlib.dll. By sending specific...

Symantec Workspace Streaming Arbitrary File Upload Exploit

This Metasploit module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the asagent.exe service, which allows for uploading arbitrary files under the server root. This Metasploit module abuses the...

Symantec Workspace Streaming Arbitrary File Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'Symantec Workspace Streaming Arbitrary File Upload', 'Description' = %q This module exploits a code executio...

Design/Logic Flaw

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

CVE-2014-1649

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

CVE-2014-1649

Symantec Workspace Streaming (SWS) server before 7.5.0.749 has an information disclosure/arbitrary file upload vulnerability in its XML-RPC handling (notably the ManagementAgentServer.putFile path), due to lack of proper access-control validation on XMLRPC requests. This allows remote, unauthenti...

CVE-2014-1649

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

Symantec Workspace Streaming ManagementAgentServer.putFile XMLRPC Request Arbitrary File Upload

This module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the asagent.exe service, which allows for uploading arbitrary files under the server root. This module abuses the auto deploy feature in...

Symantec Workspace Streaming Agent XMLRPC Request putFile Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Workspace Streaming. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SWS Agent asagent.exe component. By sending a crafted XMLRPC request ...

Symantec Workspace Streaming XMLRPC Unauthenticated Access

SUMMARY The management server for Symantec Workspace Streaming SWS does not properly handle external XMLRPC requests, which could potentially allow unauthorized access to restricted server-side data and server functionality. A remote user could potential create a backdoor on the targeted server...

CVE-2014-2935

costview3/xmlrpcserver/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request...

Cross site request forgery (csrf)

costview3/xmlrpcserver/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request...

CVE-2014-2935

CVE-2014-2935 affects CostView in Caldera 9.20. The vulnerability exists in /costview3/xmlrpc_server/xmlrpc.php where a crafted XMLRPC request can inject shell metacharacters in a methodCall, allowing an unauthenticated remote attacker to execute arbitrary commands on the server. Connected source...