3951 matches found
CVE-2014-8361
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023...
CVE-2014-8361
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023...
CVE-2014-8361
CVE-2014-8361 affects Realtek SDK’s miniigd UPnP SOAP service. The root cause is improper input validation in the NewInternalClient handling, enabling a remote attacker to execute arbitrary code. The description notes exploitation in the wild through 2023. Related sources indicate this vulnerabil...
CVE-2014-8361
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023...
Routers Vulnerable to Critical Remote Code Execution Vulnerability
A zero day vulnerability in popular household routers from D-Link and Trendnet could be exploited by attackers to run arbitrary code on devices. The flaw, which can be exploited without authentication, is present in version 1.3 of Realtek’s SDK, which figures into some brands of routers, accordin...
Fedora 20 : php-5.5.24-1.fc20 (2015-6399)
16 Apr 2015, PHP 5.5.24 Apache2handler : - Fixed bug 69218 potential remote code execution with apache 2.4 apache2handler. Gerrit Venema Core : - Fixed bug 66609 php crashes with get and ++ operator in some cases. Dmitry, Laruence - Fixed bug 67626 User exceptions not properly handled in streams...
Netgear Unauthenticated SOAP Password Extractor
This module exploits an authentication bypass vulnerability in different Netgear devices. It allows to extract the password for the remote management interface. This module has been tested on a Netgear WNDR3700v4 - V1.0.1.42, but other devices are reported as vulnerable: NetGear WNDR3700v4 -...
(0Day) Realtek SDK miniigd AddPortMapping SOAP Action Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Realtek SDK. Authentication is not required to exploit this vulnerability. The specific flaw exists within the miniigd SOAP service. The issue lies in the handling of the NewInternalClient...
Fedora 21 : php-5.6.8-1.fc21 (2015-6407)
16 Apr 2015, PHP 5.6.8 Core : - Fixed bug 66609 php crashes with get and ++ operator in some cases. Dmitry, Laruence - Fixed bug 68021 getbrowser browsernameregex returns non-utf-8 characters. Tjerk - Fixed bug 68917 parseurl fails on some partial urls. Wei Dai - Fixed bug 69134 Per Directory...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.61.9 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts, aka Bug ID CSCus97494...
CVE-2015-0705
CVE-2015-0705 is a CSRF vulnerability in the SOAP API endpoints of the Cisco Unified MeetingPlace web-services directory, version 8.6(1.9). An attacker could hijack administrator authentication to create new admin accounts (Bug ID CSCus97494). Public details in the provided documents confirm the ...
CVE-2015-0705
Cross-site request forgery CSRF vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.61.9 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts, aka Bug ID CSCus97494...
Cisco Unified MeetingPlace Web Services Directory SOAP API Endpoints Cross-Site Request Forgery Vulnerability
A vulnerability in the SOAP application programming interface API endpoints of the web services directory of Cisco Unified MeetingPlace could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections in...
CXF: HTML content posted to SOAP endpoint could cause OOM errors
A denial of service flaw was found in the way Apache CXF created error messages for certain POST requests. A remote attacker could send a specially crafted request which, when processed by an application using Apache CXF, could consume an excessive amount of memory on the system, possibly...
CXF: Large invalid content could cause temporary space to fill
It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of dis...
CXF: HTML content posted to SOAP endpoint could cause OOM errors
A denial of service flaw was found in the way Apache CXF created error messages for certain POST requests. A remote attacker could send a specially crafted request which, when processed by an application using Apache CXF, could consume an excessive amount of memory on the system, possibly...
CVE-2015-2223
Multiple cross-site scripting XSS vulnerabilities in the web-based console management interface in Palo Alto Networks Traps formerly Cyvera Endpoint Protection 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the 1 Arguments, 2 FileName, or 3 URL parameter in a SOAP...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the web-based console management interface in Palo Alto Networks Traps formerly Cyvera Endpoint Protection 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the 1 Arguments, 2 FileName, or 3 URL parameter in a SOAP...
CVE-2015-2223
Summary : CVE-2015-2223 is a stored XSS vulnerability in Palo Alto Networks Traps Server/ESM Console (3.1.2.1546) where an attacker can inject JavaScript via SOAP requests and have it executed in an authenticated administrator’s browser. The weakness arises from how the SOAP parameters (Arguments...
CVE-2015-2223
Multiple cross-site scripting XSS vulnerabilities in the web-based console management interface in Palo Alto Networks Traps formerly Cyvera Endpoint Protection 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the 1 Arguments, 2 FileName, or 3 URL parameter in a SOAP...