388 matches found
Directory traversal
Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager aka RPRM before 8.4 allow 1 remote authenticated users to read arbitrary files via a .. dot dot in the Modifier parameter to PlcmRmWeb/FileDownload; or remote authenticated administrators to upload arbitrary fil...
Alienvault OSSIM av-centerd 4.7.0 get_log_line Command Injection
require 'msf/core' require 'rexml/document' class MetasploitModule 'Alienvault OSSIM av-centerd Command Injection getlogline', 'Description' = %q This module exploits a command injection flaw found in the getlogline function found within Util.pm. The vulnerability is triggered due to an unsanitiz...
openSUSE Security Update : php7 (openSUSE-2017-994)
This update for php7 fixes the following issues : - CVE-2016-10397: parseurl can be bypassed to return fake host. bsc1047454 - CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/phpvariables. bsc1048100 -...
Security update for php7 (important)
This update for php7 fixes the following issues: - CVE-2016-10397: parseurl can be bypassed to return fake host. bsc1047454 - CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/phpvariables. bsc1048100 -...
CVE-2012-0803
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request...
SAP Patches High-Risk Flaws in SAP POS, Host Agent
SAP fixed 23 vulnerabilities across roughly a dozen products on Tuesday, including a series of high-risk flaws that could allow an attacker to gain access to SAP POS, the company’s client/server point-of-sale PoS solution. The issues in SAP POS, a series of missing authorization checks, could let...
(0Day) Schneider Electric U.motion Builder SOAP Request Remote SQL Command Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary SQL commands on vulnerable installations of Schneider Electric U.Motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of SOAP requests by the web service. The system...
CVE-2016-9736
IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information...
PT-2017-3701 · Schneider Electric · Modicon Premium +3
Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon M340 versions affected versions not specified Schneider Electric Modicon Premium versions affected versions not specified Schneider Electric Modicon Quantum versions affected versions not specified Schneider Electri...
The vulnerability of the PHP interpreter allows attackers to trigger a service failure or execute arbitrary code.
The vulnerability of the makehttpsoaprequest function ext/soap/phphttp.c in the PHP interpreter is related to pointer arithmetic errors. Exploiting this vulnerability could allow a malicious actor to cause service failure pointer arithmetic errors, application termination, or execute arbitrary co...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the Mail interface in Zimbra Collaboration Server ZCS before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest...
DLA-444-1 php5 - security update
Bulletin has no description...
Ipswitch WhatsUp Gold < 16.4 Multiple Vulnerabilities
According to its self-reported version number, the version of Ipswitch WhatsUp Gold running on the remote host is prior to 16.4.0. It is, therefore, affected by the following vulnerabilities : - Multiple SQL injection vulnerabilities exist due to improper sanitization of user-supplied input to th...
HP Operations Manager for Windows 8.x and 9.0 Java Object Deserialization RCE
The version of HP Operations Manager installed on the remote host has the Sam Admin Adapter installed. This package is no longer supported by HP and is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collectio...
Ipswitch WhatsUp Gold < 16.4 Multiple Vulnerabilities
The remote host has a version of Ipswitch WhatsUp Gold installed that is prior to 16.4.0. It is, therefore, affected by the following vulnerabilities : - Multiple SQL injection vulnerabilities exist due to improper sanitization of user-supplied input to the 'sUniqueID' parameter and the 'find...
Ipswitch WhatsUp Gold SQL injection Vulnerability(CVE-2 0 1 5-8 2 6 1)-vulnerability warning-the black bar safety net
Affected system: Ipswitch WhatsUp Gold 〈 16.4 Description: CVECAN ID: CVE-2 0 1 5-8 2 6 1 WhatsUp Gold offers a complete easy-to-use monitoring mechanism for comprehensive monitoring of application services and network equipment, and assist IT managers the network management information into a...
CVE-2015-8261
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request...
Sql injection
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request...
CVE-2015-8261
Ipswitch WhatsUp Gold before 16.4 is vulnerable to SQL injection via the DroneDeleteOldMeasurements SOAP handler, caused by improper validation of serialized XML objects. A remote attacker can craft a SOAP request to inject/manipulate SQL in the back-end database, potentially exposing or altering...
CVE-2015-8261
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request...