Schneider Electric U.motion Builder editscript remote code execution vulnerability

U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in the Schneider Electric U.motion Builder editscript. It allows a caller with standard user privileges to write arbitrary PHP files anywhere in the web service directory tree. An...

(0Day) Schneider Electric U.motion Builder track_getdata SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of trackgetdata.php, which is exposed on the web servic...

(0Day) Schneider Electric U.motion Builder loadtemplate SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of loadtemplate.php, which is exposed on the web servic...

(0Day) Schneider Electric U.motion Builder message_simple_html reboot Parameter Denial of Service Vulnerability

This vulnerability allows remote attackers to deny service on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of messagesimplehtml.php, which is exposed on the web service. Th...

(0Day) Schneider Electric U.motion Builder xmlserver SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of xmlserver.php, which is exposed on the web service...

(0Day) Schneider Electric U.motion Builder localize SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of localize.php, which is exposed on the web service wi...

(0Day) Schneider Electric U.motion Builder nfcserver SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of nfcserver.php, which is exposed on the web service...

(0Day) Schneider Electric U.motion Builder syslog_getdata SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of sysloggetdata.php, which is exposed on the web servi...

(0Day) Schneider Electric U.motion Builder SOAP Request Remote SQL Command Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL commands on vulnerable installations of Schneider Electric U.Motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of SOAP requests by the web service. The system...

(0Day) Schneider Electric U.motion Builder track_import_export SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of trackimportexport.php, which is exposed on the web...

(0Day) Schneider Electric U.motion Builder HTTP Cookie SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of applets which are exposed on the web service. The...

(0Day) Schneider Electric U.motion Builder Hard-Coded Password Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. The specific flaw exists within the configuration of the product. The web service comes with a hidden system account with a hard-coded password. An attacker can...

Access Restriction Bypass Due To Web Service Access Token Issue

Moodle is vulnerable to access restriction bypass. The vulnerability exists because it does not restrict the running of functions from any external services which are not linked to the web service access token. Using this flaw, an authenticated user can run any arbitrary functions from any extern...

The vulnerability of the Oracle Web Services component of the Oracle Fusion Middleware software platform allows attackers to compromise the integrity, accessibility, and confidentiality of information.

Vulnerability of the Oracle Web Services component of the Oracle Fusion Middleware software platform. Exploitation of this vulnerability could allow a malicious actor to compromise the integrity, availability, and confidentiality of information by manipulating the JAXWS web service stack...

RESTEasy XML External Entity Injection Vulnerability

RESTEasy is the United States Red Hat Red Hat, Inc. of a JBoss open source project , which provides a variety of frameworks for building RESTful Web Services and RESTful Java applications . RESTEasy has an XML external entity injection vulnerability. An attacker could exploit this vulnerability t...

Apache Archiva Cross-Site Request Forgery Vulnerability

Apache Archiva is a suite of software from the Apache USA Software Foundation for managing one or more remote repositories. The software provides features such as remote Repository agents, role-based secure access management, and usage reporting. A cross-site request forgery vulnerability exists ...

SQL Injection Vulnerability in WSLoginMobile.asmx?wsdl Parameter on iOffice System

Redfan iOffice system is a Microsoft .NET technology based on the development of the establishment of notebooks, cell phones and other convenient terminals as a carrier to realize the mobile information system. iOffice system WSLoginMobile.asmx?wsdl parameter exists SQL injection vulnerability, t...

CVE-2017-6565

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. As no sanitization checks are in place, an attacker can upload a malicious payload...

CVE-2017-6565

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. As no sanitization checks are in place, an attacker can upload a malicious payload...

CVE-2017-3533

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker wi...