Design/Logic Flaw

The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128...

CVE-2013-3319

CVE-2013-3319 affects SAP NetWeaver 7.03 via the HostControl service GetComputerSystem method, enabling remote disclosure of sensitive information through a crafted SOAP request to port 1128. Public references in Nessus note and vendor advisories (SAP Note 1816536) detail sensitive data exposure ...

CVE-2013-3319

The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128...

Oracle Endeca Server createDataStore SOAP Request Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Endeca Server. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of requests to the controlSoapBinding web service. This service exposes...

Oracle Endeca Server attachDataStore SOAP Request Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Endeca Server. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of requests to the controlSoapBinding web service. This service exposes...

SAP NetWeaver SOAP Request SXPG_COMMAND_EXECUTE Command Execution

A remote command execution vulnerability has been reported in SAP NetWeaver's SOAP interface. The vulnerability is due to insufficient validation of incoming SOAP requests. A remote, authenticated attacker can exploit this vulnerability by sending a specially crafted SOAP request to the affected...

ReadyMedia - Remote Heap Buffer Overflow

source: https://www.securityfocus.com/bid/61282/info ReadyMedia is prone to a remote heap-based buffer-overflow vulnerability. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service...

Belkin Wemo - Arbitrary Firmware Upload

Exploit Title: Belkin Wemo Arbitrary Firmware Vulnerability Date: 4/3/13 Exploit Author: Daniel Buentello Vendor Homepage: http://www.belkin.com/us/wemo Version: Any version prior to WeMoUS2.00.2176.PVT CVE : CVE-2013-2748 POST /upnp/control/firmwareupdate1 HTTP/1.1 SOAPACTION:...

CVE-2013-0239

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element...

Authentication flaw

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element...

Cross site request forgery (csrf)

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

CVE-2012-5703

The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service host daemon crash via an invalid value in a 1 RetrieveProp or 2 RetrievePropEx SOAP request...

Cross site request forgery (csrf)

The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service host daemon crash via an invalid value in a 1 RetrieveProp or 2 RetrievePropEx SOAP request...

FileBound - Privilege Escalation Vulnerability - Security Advisory - SOS-12-010

Sense of Security - Security Advisory - SOS-12-010 Release Date. 10-Oct-2012 Last Update. - Vendor Notification Date. 14-Aug-2012 Product. FileBound On-Site Platform. Windows Affected versions. All versions prior to 6.2 Severity Rating. High Impact. Privilege escalation Attack Vector. From remote...

FileBound 6.2 - Local Privilege Escalation

FileBound 6.2 - Local Privilege Escalation Sense of Security - Security Advisory - SOS-12-010 Release Date. 10-Oct-2012 Last Update. - Vendor Notification Date. 14-Aug-2012 Product. FileBound On-Site Platform. Windows Affected versions. All versions prior to 6.2 Severity Rating. High Impact...

FileBound On-Site Privilege Escalation

Sense of Security - Security Advisory - SOS-12-010 Release Date. 10-Oct-2012 Last Update. - Vendor Notification Date. 14-Aug-2012 Product. FileBound On-Site Platform. Windows Affected versions. All versions prior to 6.2 Severity Rating. High Impact. Privilege escalation Attack Vector. From remote...

AP NetWeaver HostControl Command Injection

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core'...

Oracle Business Transaction Management Server 12.1.0.2.7 FlashTunnelService - Remote File Deletion

Oracle Business Transaction Management Server 12.1.0.2.7 FlashTunnelService - Remote File Deletion Oracle Business Transaction Management Server 12.1.0.2.7 FlashTunnelService Remote File Deletion tested against: Microsoft Windows Server 2003 r2 sp2 Oracle WebLogic Server 12c 12.1.1 Oracle Busines...

Umbraco CMS - Remote Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Umbraco CMS Remote Command Execution'...

Umbraco CMS Remote Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Umbraco CMS Remote Command Execution'...