CVE-2021-20173

Netgear Nighthawk R6700 router (firmware 1.0.4.120) is affected by a command-injection vulnerability in the update functionality exposed via the SOAP interface. A system update check can be triggered with preconfigured values to inject commands. Root cause: insecure handling in the update/SOAP pa...

Netgear Nighthawk R6700操作系统命令注入漏洞

The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. A command injection vulnerability exists in the Netgear Nighthawk R6700, which stems from the fact that the product supports update checking via the soap interface and can be injected with a pre-set value. No details of the...

Multiple vulnerabilities in KONICA MINOLTA MFPs and printing systems

Overview Multi-function printers MFP and printing systems provided by KONICA MINOLTA, INC. contain multiple vulnerabilities listed below. Incorrect authorization CWE-863 - CVE-2021-20868 Exposure of sensitive information to an unauthorized actor CWE-200 - CVE-2021-20869 Improper handling of...

The vulnerability of the WS-Addressing plugin in the gSOAP web service development environment allows a attacker to cause a service failure.

The vulnerability of the WS-Addressing plugin in the gSOAP web service development environment is related to errors in pointer manipulation during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment allows a attacker to trigger a service failure.

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment is related to errors in pointer manipulation during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment allows a attacker to trigger a service failure.

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment is related to errors in pointer manipulation during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment allows a perpetrator to execute arbitrary code.

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment is related to integer overflow during SOAP request processing. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially crafted HTTP requests...

API Security Tutorial

Historial API Evolution As per the documented history, the occurrence of web APIs transpired towards the end of 1990 with the launch of Salesforce’s sales automation solution. At that point in time, it was an open resource, awarded to everyone. Salesforce’s automation tool was XML-driven and the...

Differences SOAP vs REST: Comparison of protocols and their security

SOAP and REST are two of the most used terms in the API development sector. If you don’t have thorough knowledge of the two, you may wonder: Why should a developer choose and ditch others? Can these two be used at a time? …and so on. Well, it’s a lot of information and is covered bit by bit in th...

Exploit for CVE-2021-42321

This repository is a proof-of-concept PoC exploit for CVE-2021-42321, a vulnerability in Microsoft Exchange Server. The PoC is written in Python and uses the requests library to send a SOAP request to the Exchange server. The exploit targets the Exchange server's GetFolder method, which can be us...

The vulnerability of the embedded software of NETGEAR R6700AX, NETGEAR R7800, NETGEAR R8900, NETGEAR R9000, NETGEAR RAX10, NETGEAR RAX120, NETGEAR RAX120v2, NETGEAR RAX70, NETGEAR RAX78, and NETGEAR XR700 lies in the ability to write data beyond the buffer, allowing an attacker to execute arbitrary code.

The vulnerability of the embedded software of NETGEAR R6700AX, NETGEAR R7800, NETGEAR R8900, NETGEAR R9000, NETGEAR RAX10, NETGEAR RAX120, NETGEAR RAX120v2, NETGEAR RAX70, NETGEAR RAX78, and NETGEAR XR700 lies in the fact that data is written beyond the buffer during syntax analysis of the...

php: NULL pointer dereference in SoapClient

A NULL pointer dereference issue is in the SOAP extension of PHP. More specifically, the flaw occurs in the SoapClient when parsing a WSDL document due to improper checking of a child node name. A malicious or compromised server replies with a crafted WSDL document, leading to a denial of service...

CVE-2021-31601

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31600

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31601

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

Design/Logic Flaw

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31600

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

Design/Logic Flaw

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31601

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...

CVE-2021-31600

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...