(0Day) SAP Sybase ESP esp_parse Connection.dispose Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.dispose function in espserverlib.dll. By sending specific arguments to...

(0Day) SAP Sybase ESP esp_parse Connection.setScanDepth Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.setScanDepth function in espserverlib.dll. By sending specific argumen...

(0Day) SAP Sybase ESP esp_parse ConnectionType.getParamNames Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the ConnectionType.getParamNames function in espserverlib.dll. By sending specific...

Symantec Workspace Streaming Arbitrary File Upload Exploit

This Metasploit module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the asagent.exe service, which allows for uploading arbitrary files under the server root. This Metasploit module abuses the...

Symantec Workspace Streaming Arbitrary File Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'Symantec Workspace Streaming Arbitrary File Upload', 'Description' = %q This module exploits a code executio...

CVE-2014-1649

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

Design/Logic Flaw

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

CVE-2014-1649

Symantec Workspace Streaming (SWS) server before 7.5.0.749 has an information disclosure/arbitrary file upload vulnerability in its XML-RPC handling (notably the ManagementAgentServer.putFile path), due to lack of proper access-control validation on XMLRPC requests. This allows remote, unauthenti...

CVE-2014-1649

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

Symantec Workspace Streaming Agent XMLRPC Request putFile Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Workspace Streaming. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SWS Agent asagent.exe component. By sending a crafted XMLRPC request ...

Symantec Workspace Streaming XMLRPC Unauthenticated Access

SUMMARY The management server for Symantec Workspace Streaming SWS does not properly handle external XMLRPC requests, which could potentially allow unauthorized access to restricted server-side data and server functionality. A remote user could potential create a backdoor on the targeted server...

Symantec Workspace Streaming ManagementAgentServer.putFile XMLRPC Request Arbitrary File Upload

This module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the asagent.exe service, which allows for uploading arbitrary files under the server root. This module abuses the auto deploy feature in...

CVE-2014-2935

costview3/xmlrpcserver/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request...

Cross site request forgery (csrf)

costview3/xmlrpcserver/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request...

CVE-2014-2935

CVE-2014-2935 affects CostView in Caldera 9.20. The vulnerability exists in /costview3/xmlrpc_server/xmlrpc.php where a crafted XMLRPC request can inject shell metacharacters in a methodCall, allowing an unauthenticated remote attacker to execute arbitrary commands on the server. Connected source...

CVE-2014-2935

costview3/xmlrpcserver/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request...

Mandriva Linux Security Advisory : python (MDVSA-2014:074)

Updated python package fixes security vulnerabilities : Denial of service flaws due to unbound readline calls in the imaplib, poplib, and smtplib modules CVE-2013-1752. A gzip bomb and unbound read denial of service flaw in python XMLRPC library CVE-2013-1753. %NASLMINLEVEL 70300 C Tenable Networ...

MGASA-2014-0139 Updated python package fixes security vulnerabilities

Denial of service flaws due to unbound readline calls in the imaplib, poplib, and smtplib modules CVE-2013-1752. A gzip bomb and unbound read denial of service flaw in python XMLRPC library CVE-2013-1753...

WordPress Pingback Distributed Denial of Service

The XMLRPC Pingback function in WordPress can be used to force WordPress servers into sending HTTP requests to other servers. Remote attackers can leverage this function to conduct DDoS attacks by sending specially crafted HTTP requests to legitimate WordPress servers...

Critical: php

Issue Overview: The asn1timetotimet function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse 1 notBefore and 2 notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of...