SAP NetWeaver SAPHostControl Command Injection

Added: 08/29/2012 BID: 55084 OSVDB: 84821 Background SAP NetWeaver is a technology platform for building and integrating SAP business applications. Problem The NetWeaver management console exposes an authenticated SOAP web service interface. During the authentication phase, user-supplied values...

SAP NetWeaver SAPHostControl Command Injection

Added: 08/29/2012 BID: 55084 OSVDB: 84821 Background SAP NetWeaver is a technology platform for building and integrating SAP business applications. Problem The NetWeaver management console exposes an authenticated SOAP web service interface. During the authentication phase, user-supplied values...

Oracle Business Transaction Management Server FlashTunnelService Remote File Deletion

Oracle Business Transaction Management Server 12.1.0.2.7 FlashTunnelService Remote File Deletion tested against: Microsoft Windows Server 2003 r2 sp2 Oracle WebLogic Server 12c 12.1.1 Oracle Business Transaction Management Server 12.1.0.2.7 Production version files tested:...

Oracle Business Transaction Management FlashTunnelService Remote Code Execution

This module exploits abuses the FlashTunnelService SOAP web service on Oracle Business Transaction Management 12.1.0.7 to upload arbitrary files, without authentication, using the WriteToFile method. The same method contains a directory traversal vulnerability, which allows to upload the files to...

CVE-2011-4583

Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with 1 disabled services and 2 users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens...

CVE-2011-4583

Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with 1 disabled services and 2 users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens...

Authorization

Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with 1 disabled services and 2 users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens...

CVE-2011-4583

Summary: CVE-2011-4583 affects Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, where web service tokens for disabled services and users no longer authorized can be read by remote authenticated users. Affected software: Moodle 2.0.x (pre-2.0.6) and Moodle 2.1.x (pre-2.1.3). Root cause (from avai...

Server side request forgery (ssrf)

The web service in AutoFORM PDM Archive before 7.1 does not have authorization requirements, which allows remote authenticated users to perform database operations via a SOAP request, as demonstrated by the initializeQueryDatabase2 request...

CVE-2012-1827

The web service in AutoFORM PDM Archive before 7.1 does not have authorization requirements, which allows remote authenticated users to perform database operations via a SOAP request, as demonstrated by the initializeQueryDatabase2 request...

CVE-2012-1827

AutoFORM PDM Archive vulnerability CVE-2012-1827 affects versions prior to 7.1. The webservice lacks authorization, allowing remote authenticated users to interact with the application database via SOAP (notably initializeQueryDatabase2), bypassing normal permissions. This can lead to unauthorize...

LANDesk ThinkManagement Suite ServerSetup.asmx Directory Traversal

Added: 04/27/2012 CVE: CVE-2012-1195 BID: 52023 OSVDB: 79276 Background LANDesk Lenovo ThinkManagement Console provides hardware discovery, comprehensive inventory, and reporting for Lenovo systems. Problem LANDesk Lenovo ThinkManagement Console runs a web application under the Microsoft IIS web...

http-icloud-findmyiphone NSE Script

Retrieves the locations of all "Find my iPhone" enabled iOS devices by querying the MobileMe web service authentication required. Script Arguments http-icloud-findmyiphone.username the Apple Id username http-icloud-findmyiphone.password the Apple Id password slaxml.debug See the documentation for...

Microsoft MSDN Flash Cross Site Scripting

Title: ====== Microsoft MSDN - Persistent Web Service Vulnerability Date: ===== 2012-04-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=450 MSRC ID1: 12152 MSRC ID2: 12228 VL-ID: ===== 450 Introduction: ============= The Microsoft Developer Network MSDN is the portio...

HP Data Protector DPNECentral Web Service Detection

HP Data Protector DPNECentral Web Service, a component of HP Data Protector for managing backup policies, is hosted on the remote web server. This service is installed with HP Data Protector for PCs, HP Data Protector Notebook Extension, and possibly other HP Data Protector software. C Tenable...

HP Data Protector LogClientInstallation Method Userid Field SQL Execution

The HP Data Protector DPNECentral web service listening on this port contains a SQL injection vulnerability because it fails to properly sanitize user-supplied input to the userid field of its LogClientInstallation method before using it in a database query. This may allow an attacker to read and...

CA Total Defense UNCWS exportReport SQL Injection

Added: 03/20/2012 OSVDB: 78930 Background CA Total Defense is a combined host-based anti-virus, anti-spyware, firewall, and IPS solution. Problem CA Total Defense includes a web service management component, which in version r12 prior to SE3, fails to validate certain parameters. The exportReport...

CA Total Defense UNCWS exportReport SQL Injection

Added: 03/20/2012 OSVDB: 78930 Background CA Total Defense is a combined host-based anti-virus, anti-spyware, firewall, and IPS solution. Problem CA Total Defense includes a web service management component, which in version r12 prior to SE3, fails to validate certain parameters. The exportReport...

CA Total Defense UNCWS exportReport SQL Injection

Added: 03/20/2012 OSVDB: 78930 Background CA Total Defense is a combined host-based anti-virus, anti-spyware, firewall, and IPS solution. Problem CA Total Defense includes a web service management component, which in version r12 prior to SE3, fails to validate certain parameters. The exportReport...

LANDesk Lenovo ThinkManagement Suite 9.0.3 Core Server - Arbitrary File Deletion

LANDesk Lenovo ThinkManagement Suite 9.0.3 Core Server WSVulnerabilityCore.dll SetTaskLogByFile Remote Arbitrary File Deletion Vulnerability Tested against: Microsoft Windows Server 2003 r2 sp2 Software home page: http://www.landesk.com/lenovo/thinkmanagement-console.aspx Download url:...