CVE-2012-4402

The CVE relates to Moodle (2.1.x before 2.1.8, 2.2.x before 2.2.5, 2.3.x before 2.3.2). The issue is that web-service tokens are not properly restricted, allowing remote authenticated users to invoke functions from external services using a token intended for a single service. Impact per sources ...

CVE-2012-0797

The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token...

CVE-2011-3667

The User.offeraccountbyemail WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when createemailregexp is not empty, does not properly handle usercancreateaccount settings, which allows remote attackers to...

Design/Logic Flaw

The User.offeraccountbyemail WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when createemailregexp is not empty, does not properly handle usercancreateaccount settings, which allows remote attackers to...

CVE-2011-3667

The User.offeraccountbyemail WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when createemailregexp is not empty, does not properly handle usercancreateaccount settings, which allows remote attackers to...

CVE-2011-3757

Moodle 2.0.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by webservice/xmlrpc/locallib.php and certain other files...

Information disclosure

Moodle 2.0.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by webservice/xmlrpc/locallib.php and certain other files...

UBUNTU-CVE-2011-3757

Moodle 2.0.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by webservice/xmlrpc/locallib.php and certain other files...

APT-WEBSHOP-SYSTEM - modules.php SQL Injection

APT-WEBSHOP-SYSTEM - modules.php SQL Injection =============================================== APT-WEBSHOP-SYSTEM modules.php SQL injection =============================================== / // // // \ / // / / // \ / | / |/ / \ \ / / / / / , // / / / / / / , // | / / //// ///||// //////||// ||//|...

APT-WEBSHOP-SYSTEM - 'modules.php' SQL Injection

=============================================== APT-WEBSHOP-SYSTEM modules.php SQL injection =============================================== / // // // \ / // / / // \ / | / |/ / \ \ / / / / / , // / / / / / / , // | / / //// ///||// //////||// ||//|/ // APT-WEBSHOP-SYSTEM modules.php SQL...

Authentication flaw

The Staging Webservice "sitecore modules/staging/service/api.asmx" in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and 1 upload files, 2 download files, 3 list directories, and 4 clear the server cache via crafted SOAP requests with arbitra...

CVE-2009-4367

The CVE concerns the Sitecore Staging Module (Sitecore Staging Module 5.4.0 rev.080625 and earlier) where the Staging Webservice (sitecore modules/staging/service/api.asmx) can be lasered by crafted SOAP requests to bypass authentication. The root cause is an authentication bypass that accepts ar...

CVE-2009-4367

The Staging Webservice "sitecore modules/staging/service/api.asmx" in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and 1 upload files, 2 download files, 3 list directories, and 4 clear the server cache via crafted SOAP requests with arbitra...

Sitecore Staging Module 5.4.0 - Authentication Bypass File Manipulation

Sitecore Staging Module 5.4.0 - Authentication Bypass File Manipulation SEC Consult Security Advisory ========================================================================== title: Authentication bypass and file manipulation in Sitecore Staging Module products: Sitecore Staging Module vulnerab...

Mozilla Bugzilla 'Bug.create()' WebService Function SQL Injection Vulnerability

Bugzilla is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Sql injection

SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

CVE-2009-3125

CVE-2009-3125 : Bugzilla 3.3.2–3.4.1 and 3.5 are affected by an SQL injection in the Bug.search WebService, allowing remote attackers to execute arbitrary SQL via unspecified parameters. The issue is within Bugzilla’s web service layer and is tied to untrusted input used in SQL queries. Several c...

Webservice-DIC yoyaku_v41 vulnerable to command injection

Overview yoyakuv41 from Webservice-DIC contains a command injection vulnerability. yoyakuv41 from Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains a command injection vulnerability. This vulnerability is different from JVN80436657. Keigo Yamazaki of LAC Co.,...

JVN#05857667 Webservice-DIC yoyaku_v41 vulnerable to command injection

yoyakuv41 from Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains a command injection vulnerability. This vulnerability is different from JVN80436657. Impact An arbitrary command could be executed with the privilege of the server where yoyakuv41 runs. Solution...

bugzilla -- two SQL injections, sensitive data exposure

A Bugzilla Security Advisory reports: It is possible to inject raw SQL into the Bugzilla database via the "Bug.create" and "Bug.search" WebService functions. When a user would change his password, his new password would be exposed in the URL field of the browser if he logged in right after changi...