Multiple vulnerabilities in KONICA MINOLTA MFPs and printing systems

Overview Multi-function printers MFP and printing systems provided by KONICA MINOLTA, INC. contain multiple vulnerabilities listed below. Incorrect authorization CWE-863 - CVE-2021-20868 Exposure of sensitive information to an unauthorized actor CWE-200 - CVE-2021-20869 Improper handling of...

The vulnerability of the WS-Addressing plugin in the gSOAP web service development environment allows a attacker to cause a service failure.

The vulnerability of the WS-Addressing plugin in the gSOAP web service development environment is related to errors in pointer manipulation during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment allows a attacker to trigger a service failure.

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment is related to errors in pointer manipulation during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment allows a attacker to trigger a service failure.

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment is related to errors in pointer manipulation during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment allows a perpetrator to execute arbitrary code.

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment is related to integer overflow during SOAP request processing. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially crafted HTTP requests...

API Security Tutorial

Historial API Evolution As per the documented history, the occurrence of web APIs transpired towards the end of 1990 with the launch of Salesforce’s sales automation solution. At that point in time, it was an open resource, awarded to everyone. Salesforce’s automation tool was XML-driven and the...

Differences SOAP vs REST: Comparison of protocols and their security

SOAP and REST are two of the most used terms in the API development sector. If you don’t have thorough knowledge of the two, you may wonder: Why should a developer choose and ditch others? Can these two be used at a time? …and so on. Well, it’s a lot of information and is covered bit by bit in th...

Exploit for CVE-2021-42321

This repository is a proof-of-concept PoC exploit for CVE-2021-42321, a vulnerability in Microsoft Exchange Server. The PoC is written in Python and uses the requests library to send a SOAP request to the Exchange server. The exploit targets the Exchange server's GetFolder method, which can be us...

The vulnerability of the embedded software of NETGEAR R6700AX, NETGEAR R7800, NETGEAR R8900, NETGEAR R9000, NETGEAR RAX10, NETGEAR RAX120, NETGEAR RAX120v2, NETGEAR RAX70, NETGEAR RAX78, and NETGEAR XR700 lies in the ability to write data beyond the buffer, allowing an attacker to execute arbitrary code.

The vulnerability of the embedded software of NETGEAR R6700AX, NETGEAR R7800, NETGEAR R8900, NETGEAR R9000, NETGEAR RAX10, NETGEAR RAX120, NETGEAR RAX120v2, NETGEAR RAX70, NETGEAR RAX78, and NETGEAR XR700 lies in the fact that data is written beyond the buffer during syntax analysis of the...

php: NULL pointer dereference in SoapClient

A NULL pointer dereference issue is in the SOAP extension of PHP. More specifically, the flaw occurs in the SoapClient when parsing a WSDL document due to improper checking of a child node name. A malicious or compromised server replies with a crafted WSDL document, leading to a denial of service...

CVE-2021-31601

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31600

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31601

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

Design/Logic Flaw

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31600

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

Design/Logic Flaw

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31601

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31600

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31600

Hitachi Vantara Pentaho (through 9.1 and Pentaho BI Server 7.x) exposes an access-control flaw in SOAP web services that allows any authenticated user to enumerate usernames. The vulnerable components are the web services exposed by /pentaho/webservices/userRoleListService and /pentaho/ServiceAct...

Pentaho Business Analytics / Pentaho Business Server 9.1 Insufficient Access Control Vulnerability

Pentaho implements a series of web services using the SOAP protocol to allow scripting interaction with the backend server. While most of the interfaces correctly implement ACL, the Data Source Management Service located at /pentaho/webservices/datasourceMgmtService allows low-privilege...