Design/Logic Flaw

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service ConfigurationService on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the...

CVE-2016-6599

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service ConfigurationService on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the...

CVE-2016-6598

BMC Track-It! 11.4 before Hotfix 3 is affected by CVE-2016-6598. An unauthenticated .NET Remoting FileStorageService on port 9010 allows uploading a file to an arbitrary path on the Track-It! server, which can lead to code execution as NETWORK SERVICE or SYSTEM. Root cause: unauthenticated remote...

CVE-2016-6598

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service FileStorageService on port 9010. This service contains a method that allows uploading a file to an arbitrary path on the machine that is running Track-It!. This can be used to upload a file to the web...

CVE-2016-6599

CVE-2016-6599 affects BMC Track-It! 11.4 prior to Hotfix 3. An unauthenticated .NET remoting service exposed on port 9010 (ConfigurationService) can disclose a configuration file containing the app database name and credentials, including domain admin credentials, encrypted with a fixed DES key/I...

Remote code execution

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java SignedObject object to the Jenkins CLI, that would be deserialized...

CVE-2017-1000354

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The login command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to...

CVE-2017-1000353

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java SignedObject object to the Jenkins CLI, that would be deserialized...

CVE-2017-1000354

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The login command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to...

CVE-2017-1000353

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java SignedObject object to the Jenkins CLI, that would be deserialized...

BMC Track-It! 11.4 Code Execution / Information Disclosure

Happy new year! I was doing some new year cleaning and realised I never released this advisory properly. Two vulnerabilities in BMC Track-It! 11.4 which were disclosed by SecuriTeam Secure Disclosure on July 2016. Posting here because I've seen quite a few of these still in active use, live and...

RemObjects Remoting SDK Cross-Site Scripting Vulnerability

RemObjects Remoting SDK for Delphi is a set of cross-platform remote mobile application development tools. A cross-site scripting vulnerability exists in RemObjects Remoting SDK for Delphi 9 version 1.0.0.0. The vulnerability can be exploited to inject arbitrary web script or HTML by sending the...

CVE-2017-16665

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting XSS attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL...

CVE-2017-16665

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting XSS attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL...

CVE-2017-16665

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting XSS attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL...

Cross site scripting

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting XSS attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL...

CVE-2017-16665

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting (XSS) attack via the service parameter to the /soap URI, as described in CVE-2017-16665. The issue arises when processing a request that triggers an invalid attempt to generate WSDL, enabling injection ...

CVE-2017-16665

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting XSS attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL...

PT-2017-14512

Name of the Vulnerable Software and Affected Versions RemObjects Remoting SDK for Delphi version 9 1.0.0.0 Description The issue allows for a reflected Cross Site Scripting XSS attack. This is achieved via the service parameter to the "/soap" URI, which triggers an invalid attempt to generate WSD...

CVE-2017-16665: Improper Neutralization of Input During Web Page Generation

RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting XSS attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL...