Xxe

SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Cross site request forgery (csrf)

The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through...

CVE-2014-2928

The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through...

CVE-2014-3243

Removed by vendor...

CVE-2014-3243

SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted SOAP request containing a large number of nested entity references...

CVE-2014-3242

Removed by vendor...

HP SiteScope issueSiebelCmd SOAP Request Code Execution - Ver2 (CVE-2013-4835)

A command execution vulnerability has been found in HP SiteScope. The vulnerability is due to lack of authentication when handling "issueSiebelCmd" SOAP requests. A remote unauthenticated attacker can exploit this vulnerability by sending crafted requests to the affected service...

CVE-2014-1608

SQL injection vulnerability in the mcifileget function in api/soap/mcfileapi.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mcissueattachmentget SOAP request...

Sql injection

SQL injection vulnerability in the mcifileget function in api/soap/mcfileapi.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mcissueattachmentget SOAP request...

Sql injection

Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a 1 getUploadPath or 2 getKBot SOAP request to service/kbotservice.php; the ID parameter to...

HP SiteScope issueSiebelCmd SOAP Request Code Execution (CVE-2013-4835)

A command execution vulnerability has been found in HP SiteScope...

HP Application Lifecycle Management GossipService SOAP Request Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Application Lifecycle Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service named GossipServiceSoapBinding. This web service i...

CVE-2013-5387

Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service process crash or hang via a malformed SOAP request with a large amount of request data...

Buffer overflow

Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service process crash or hang via a malformed SOAP request with a large amount of request data...

CVE-2013-5387

Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service process crash or hang via a malformed SOAP request with a large amount of request data...

Design/Logic Flaw

Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management ALM allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1759...

CVE-2013-4836

Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management ALM allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1759...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...

HP LoadRunner EmulationAdmin Web Service Directory Traversal

This module exploits a directory traversal vulnerability in version 11.52 of HP LoadRunner. The vulnerability exists in the EmulationAdmin web service, specifically in the copyFileToServer method, allowing the upload of arbitrary files. This module has been tested successfully on HP LoadRunner...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...