Design/Logic Flaw

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

CVE-2014-2504

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

MGASA-2014-0230 Updated moodle packages fix multiple vulnerabilities

Updated moodle package fixes security vulnerabilities: In Moodle before 2.6.3, Session checking was not being performed correctly in Assignment's quick-grading, allowing forged requests to be made unknowingly by authenticated users CVE-2014-0213. In Moodle before 2.6.3, MoodleMobile web service...

OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026801)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423...

AlienVault OSSIM av-centerd Command Injection

This module exploits a code execution flaw in AlienVault 4.6.1 and prior. The vulnerability exists in the av-centerd SOAP web service, where the updatesysteminfodebianpackage method uses perl backticks in an insecure way, allowing command injection. This module has been tested successfully on...

TeamHelpdesk Customer Web Service (CWS) 8.3.5 Technician Web Access (TWA) 8.3.5 - Remote User Credential Dump

TeamHelpdesk Customer Web Service CWS 8.3.5 Technician Web Access TWA 8.3.5 - Remote User Credential Dump Exploit Title: Team Helpdesk Customer Web Service CWS Remote User Credential Dump exploit Exploit Title: Team Helpdesk Technician Web Access TWA Remote User Credential Dump exploit Date: May ...

TeamHelpdesk Customer Web Service (CWS) 8.3.5 & Technician Web Access (TWA) 8.3.5 - Remote User Credential Dump

Exploit Title: Team Helpdesk Customer Web Service CWS Remote User Credential Dump exploit Exploit Title: Team Helpdesk Technician Web Access TWA Remote User Credential Dump exploit Date: May 5, 2014 Exploit Author: bhamb [email protected] Vendor Homepage: http://www.assistmyteam.net/TeamHelpdesk/...

Hewlett-Packard Virtual User Generator EmulationAdmin Service Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Virtual User Generator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed EmulationAdminSoapBinding web service. The issue lies in the...

Advantech WebAccess DBVisitor.dll SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DBVisitor.dll component. Multiple SOAP requests implemented by the component a...

EMC Cloud Tiering Appliance User Interface Default Credentials

The remote EMC Cloud Tiering Appliance user interface uses a known set of default credentials. Knowing these, an attacker with access to the service can gain administrative access to the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Code injection

mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors...

CVE-2014-2572

mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors...

CVE-2014-2572

mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors...

CVE-2014-2572

CVE-2014-2572 affects Moodle 2.6.x prior to 2.6.2. The issue resides in mod/assign/externallib.php where assignment web-service parameters are not properly handled, potentially allowing remote authenticated users to modify grade metadata via unspecified vectors. Impact is limited to grade metadat...

JFrog Artifactory Detection (HTTP)

HTTP based detection of JFrog Artifactory. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

SolarWinds Server & Application Monitor多个安全漏洞

SolarWinds Server and Application Monitor是一款用于监视服务器和应用软件的工具。 SolarWinds Server and Application Monitor存在多个安全漏洞： 1，创建节点时没有正确过滤Name, AssetTag, City, Comments, Departments和PONNumber字段的数据，远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 2，没有正确过滤相关SNMP公共串和SNMP...

HP LoadRunner Virtual User Generator EmulationAdmin Directory Traversal (CVE-2013-4837)

Multiple directory traversal vulnerabilities exist in HP LoadRunner. These vulnerabilities are due to a lack of input validation on SOAP requests, specifically, the copyFileToServer and the getFileContentAsLines operations of the EmulationAdmin web service. Unauthenticated remote attackers could...

CVE-2014-0622

The CVE-2014-0622 issue affects EMC Documentum Foundation Services (DFS) across DFS 6.5–6.7, 7.0, and 7.1 family (including My Documentum for Desktop/Outlook and CenterStage variants) where the DFS web service handling content upload fails to enforce access controls. Root cause: improper handling...

Yahoo!: Bypass of anti-SSRF defenses in YahooCacheSystem (affecting at least YQL and Pipes)

Thank you for your submission to Yahoo’s Bug Bounty program. There were similar reports submitted, this report is marked as closed as the other reports will be triaged. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program. ...

SAP Host Agent SOAP Web Service Information Disclosure (SAP Note 1816536)

The version of SAP Host Agent discloses sensitive system information, such as operating system version, databases version, CPU make and model, and information on network interfaces. A remote, unauthenticated attacker could use this to specialize attacks. %NASLMINLEVEL 70300 C Tenable Network...