CVE-2017-15297

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...

Authentication flaw

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...

CVE-2017-15297

CVE-2017-15297 concerns SAP Hostcontrol where the SOAP SAPControl endpoint does not require authentication, enabling unauthenticated access. The vulnerability is documented in SAP Security Note 2442993. According to the NVD entry, the affected component is the SAP Hostcontrol SOAP interface, with...

CVE-2017-15297

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...

Apache OpenMeetings Web Services Detection

This host is running Apache OpenMeetings, a software used for presenting, online training, web conferencing, collaborative whiteboard drawing and document editing, and user desktop sharing. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced...

IBM Open Admin Tool SOAP welcomeServer PHP Command Injection

Added: 09/27/2017 CVE: CVE-2017-1092 BID: 98615 Background IBM Informix Dynamic Server IDS is an online transaction processing OLTP data server for enterprise and workgroup computing. Open Admin Tool OAT is an open source, platform-independent tool providing a graphical interface for administrati...

Directory traversal

Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager aka RPRM before 8.4 allow 1 remote authenticated users to read arbitrary files via a .. dot dot in the Modifier parameter to PlcmRmWeb/FileDownload; or remote authenticated administrators to upload arbitrary fil...

HPSBPI03566 Rev 3 - HP DesignJet, OfficeJet, LaserJet, PageWide, Photosmart Printers, Execution of Arbitrary Code or Denial of Service

Potential Security Impact Execution of arbitrary code or Denial of Service Source: HP Product Security Response Team PSRT Reported by: Check Point Software VULNERABILITY SUMMARY Integer overflow in SOAP Simple Object Access Protocol function in Genivia gSOAP allows execution of arbitrary code or...

FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY

FireEye recently detected a malicious Microsoft Office RTF document that leveraged CVE-2017-8759, a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents. FireEye analyzed a Microsoft...

Alienvault OSSIM av-centerd 4.7.0 get_log_line Command Injection

require 'msf/core' require 'rexml/document' class MetasploitModule 'Alienvault OSSIM av-centerd Command Injection getlogline', 'Description' = %q This module exploits a command injection flaw found in the getlogline function found within Util.pm. The vulnerability is triggered due to an unsanitiz...

Immunity Canvas: OFFICE_WSDL

Name| officewsdl ---|--- CVE| CVE-2017-8759, CVE-2017-8570 Exploit Pack| CANVAS Description| Microsoft Office Moniker/WSDL C Injection Notes| CVE Name: CVE-2017-8759, CVE-2017-8570 VENDOR: https://office.com Notes: Send the resulting document to someone and have them open it. If the target is...

Alienvault OSSIM av-centerd 4.7.0 - get_log_line Command Injection (Metasploit)

Alienvault OSSIM av-centerd 4.7.0 - getlogline Command Injection Metasploit require 'msf/core' require 'rexml/document' class MetasploitModule 'Alienvault OSSIM av-centerd Command Injection getlogline', 'Description' = %q This module exploits a command injection flaw found in the getlogline...

Microsoft .NET framework SOAP Moniker PrintClientProxy remote code execution vulnerability

Overview The Microsoft .NET framework fails to properly parse WSDL content, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The PrintClientProxy method in the WSDL-parsing component of the Microsoft .NET framework fails to properly...

Microsoft .NET Framework Remote Code Execution Vulnerability

Microsoft .NET Framework is the new managed code programming model for Windows. A remote code execution vulnerability in Microsoft .NET Framework, which primarily affects the .NET Framework's SOAP WSDL Web Services Description Language parser, can be exploited to spread malware by constructing a...

Alienvault OSSIM av-centerd 4.7.0 - (get_log_line) Command Injection Exploit

Exploit for linux platform in category remote exploits require 'msf/core' require 'rexml/document' class MetasploitModule 'Alienvault OSSIM av-centerd Command Injection getlogline', 'Description' = %q This module exploits a command injection flaw found in the getlogline function found within...

Alienvault OSSIM av-centerd Util.pm sync_rserver - Command Execution Exploit

Exploit for linux platform in category remote exploits require 'msf/core' class MetasploitModule 'Alienvault OSSIM av-centerd Util.pm syncrserver Command Execution', 'Description' = %q This module exploits a command injection vulnerability found within the syncrserver function in Util.pm. The...

FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY

FireEye recently detected a malicious Microsoft Office RTF document that leveraged CVE-2017-8759, a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents. FireEye analyzed a Microsoft...

FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY

FireEye recently detected a malicious Microsoft Office RTF document that leveraged CVE-2017-8759, a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents. FireEye analyzed a Microsoft...

PT-2017-2916

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 through 4.7 Description A remote code execution issue exists due to insufficient input validation in the IsValidUrl method of the SOAP WSDL Parser module. This allows an attacker to execute arbitrary code...

openSUSE Security Update : php7 (openSUSE-2017-994)

This update for php7 fixes the following issues : - CVE-2016-10397: parseurl can be bypassed to return fake host. bsc1047454 - CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/phpvariables. bsc1048100 -...