pidgin: DoS via multiple null pointer dereferences in MSN protocol plugin

Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service NULL pointer dereference and crash via a crafted 1 SOAP response, 2 OIM XML response, or 3 Content-Length header...

CVE-2013-6482

Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service NULL pointer dereference and crash via a crafted 1 SOAP response, 2 OIM XML response, or 3 Content-Length header...

SAP Host Agent SOAP Web Service Information Disclosure (SAP Note 1816536)

The version of SAP Host Agent discloses sensitive system information, such as operating system version, databases version, CPU make and model, and information on network interfaces. A remote, unauthenticated attacker could use this to specialize attacks. %NASLMINLEVEL 70300 C Tenable Network...

Vtiger CRM 5.1.0 - 5.4.0 Authentication Bypass Vulnerability - Active Check

Vtiger CRM is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vtiger:vtigercrm";...

Sql injection

Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a 1 getUploadPath or 2 getKBot SOAP request to service/kbotservice.php; the ID parameter to...

[Netsparker v3.2] Web Application Security Scanner

Netsparker can crawl, attack and identify vulnerabilities in all custom web applications regardless of the platform and the technology they are built on, just like an actual attacker. It can identify web application vulnerabilities like SQL Injection, Cross-site Scripting XSS, Remote Code Executi...

PHP 5.5.x < 5.5.8 Multiple Vulnerabilities

According to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.8. It is, therefore, potentially affected by the following vulnerabilities : - A heap-based buffer overflow error exists in the file 'ext/date/lib/parseisointervals.c' related to handling...

vTiger CRM AddEmailAttachment arbitrary file upload

Added: 01/10/2014 CVE: CVE-2013-3214 BID: 61558 OSVDB: 95902 Background vTiger CRM is a customer relationship management application written in PHP. Problem An arbitrary file upload vulnerability when handling SOAP AddEmailAttachment requests allows remote attackers to execute arbitrary commands ...

vTiger CRM SOAP AddEmailAttachment任意文件上传漏洞

BUGTRAQ ID：61558 CVE ID：CVE-2013-3214 vtiger CRM是一套基于Web以销售能力自动化SFA为主的客户关系管理系统CRM 。 vtiger CRM /soap/vtigerolservice.php所定义的AddEmailAttachment SOAP方法不正确过滤通过"filedata"和"filename"参数提交的输入，允许攻击者利用漏洞写/覆盖任意文件，并以WEB权限执行。 0 vtiger vtiger CRM 5.0.0 - 5.4.0 厂商补丁： vtiger ----- 用户可参考如下厂商提供的安全补丁以修复此漏洞：...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload Vulnerability

vTiger CRM allows an user to bypass authentication when requesting SOAP services. In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP service. By combining both vulnerabilities an attacker can upload and execute PHP code. This Metasploit module has been tested...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload', 'Description' = %q vTiger CRM allows an user to...

vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload', 'Description' = %q vTiger CRM allows an user to...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload

vTiger CRM allows a user to bypass authentication when requesting SOAP services. In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP service. By combining both vulnerabilities an attacker can upload and execute PHP code. This module has been tested successfully on...

Xml eXternal Entity Vulnerability in Hitachi Cosminexus

Overview When using Cosminexus JAX-WS, XXE Xml eXternal Entity in Hitachi Cosminexus Component Container contains a vulnerability that may cause information leakage. Impact A remote attacker could obtain information via SOAP message loading unexpected external entities. Solution Please refer to t...

HP SiteScope 'issueSiebelCmd' SOAP请求远程代码执行漏洞

BUGTRAQ ID: 63478 CVECAN ID: CVE-2013-4835 HP SiteScope是无代理监控软件，可维护其分布式IT基础架构的可用性和性能。 HP SiteScope 11.22之前版本在处理"issueSiebelCmd" SOAP请求的实现上存在安全漏洞，成功利用后可导致执行任意代码。 0 HP SiteScope 11.22 厂商补丁： HP -- HP已经为此发布了一个安全公告（HPSBMU02933）以及相应补丁: HPSBMU02933：HP SiteScope, issueSiebelCmd SOAP Request, Remote Code...

Zimbra Collaboration Server LFI

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'Zimbra Collaboration Server LFI', 'Description' = %q This module exploits a local file inclusion on Zimbra...

HP SiteScope issueSiebelCmd SOAP Request Code Execution (CVE-2013-4835)

A command execution vulnerability has been found in HP SiteScope...

IBM Platform Symphony SOAP Requests Processing Buffer Overflow (CVE-2013-5387)

A buffer overflow vulnerability has been reported in IBM Platform Symphony...

HP Operations Orchestration Central 9.06 Cross Site Scripting

Name: XSS in HP Operations Orchestration Central version 9.06 Systems Affected: HP Operations Orchestration version 9.06 Severity: High Vendor: Hewlett-Packard References: CVE-2013-6191, CVE-2013-6192, SSRT101342 Author: Bart Leppens Date: 20130919 I. BACKGROUND HP Operations Orchestration HP OO ...

Zimbra Collaboration Server LFI

This module exploits a local file inclusion on Zimbra 8.0.2 and 7.2.2. The vulnerability allows an attacker to get the LDAP credentials from the localconfig.xml file. The stolen credentials allow the attacker to make requests to the service/admin/soap API. This can then be used to create an...