xmlrpc-c security update

An update is available for xmlrpc-c. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list XML-RPC is a remote procedure call RPC protocol that uses XML to encode its...

CentOS 8 : xmlrpc-c (CESA-2022:7692)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7692 advisory. - expat: Integer overflow in doProlog in xmlparse.c CVE-2021-46143 - expat: Integer overflow in addBinding in xmlparse.c CVE-2022-22822 - expat: Intege...

RHEL 8 : xmlrpc-c (RHSA-2022:7692)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7692 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages...

The vulnerability of the xmlrpc component in the software solutions for control, management, and auditing of Zoho ManageEngine Password Manager Pro, as well as the software solution for managing privileged sessions in Zoho ManageEngine Access Manager Plus, allows a perpetrator to execute arbitrary code.

The vulnerability of the xmlrpc component in the Zoho ManageEngine Password Manager Pro and Zoho ManageEngine Access Manager Plus software solutions for control, management, and auditing functions is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could all...

CVE-2022-33941

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as...

CVE-2022-33941

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as...

Command injection

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as...

CVE-2022-33941

CVE-2022-33941 : PowerCMS XMLRPC API from Alfasado Inc. contains a command injection vulnerability reachable via POST requests, allowing arbitrary Perl script execution and potentially arbitrary OS commands. Affected: PowerCMS 6.021 and earlier, 5.21 and earlier, 4.51 and earlier; developer notes...

CVE-2022-33941

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as...

PT-2022-21927 · Alfasado · Powercms

Name of the Vulnerable Software and Affected Versions: PowerCMS versions 6.021 and earlier PowerCMS versions 5.21 and earlier PowerCMS versions 4.51 and earlier PowerCMS 3 Series and earlier Description: The PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection issue. By...

Amazon Linux 2022 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2022-2022-080)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-080 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This...

PowerCMS XMLRPC API vulnerable to command injection

Overview PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability CWE-74. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. According to the...

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

Command injection

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

CVE-2022-38078

CVE-2022-38078 affects Movable Type XMLRPC API. A POST request to the XMLRPC endpoint can execute arbitrary Perl scripts and OS commands due to a command-injection flaw in MT/MT Advanced/MT Premium lines (versions 7 r.5202 and earlier; 6.8.6 and earlier; 1.52 and earlier). All MT 4.0+ EOL version...

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

PT-2022-4446 · Unknown · Movable Type Premium Advanced +3

Name of the Vulnerable Software and Affected Versions: Movable Type versions 4.0 and later Movable Type versions 7 r.5202 and earlier Movable Type Advanced versions 7 r.5202 and earlier Movable Type versions 6.8.6 and earlier Movable Type Advanced versions 6.8.6 and earlier Movable Type Premium...

PT-2022-4859 · Zoho · Zoho Manageengine Pam360 +2

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Password Manager Pro versions prior to 12101 Zoho ManageEngine PAM360 versions prior to 5510 Zoho ManageEngine Access Manager Plus versions prior to 4303 Description: The issue is related to a deserialization mechanism flaw ...