Security feature bypass

The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method...

UBUNTU-CVE-2016-3163

The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method...

CVE-2016-3163

The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method...

CVE-2016-3163

CVE-2016-3163 affects the Drupal core XML-RPC subsystem. Drupal 6.x prior to 6.38 and 7.x prior to 7.43 allows remote attackers to perform brute‑force attacks by issuing a large number of calls to the same XML-RPC method, potentially aiding password guessing. Mitigation in public advisories: appl...

CVE-2016-3163

Removed by vendor...

CVE-2016-3163: Undefined Security Weakness

The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method...

Drupal 7.x < 7.43 Multiple Vulnerabilities

Binary data 9220.prm...

Drupal 7.x < 7.43 Multiple Vulnerabilities

The version of Drupal running on the remote web server is 7.x prior to 7.43. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the File module that allows an attacker to view, delete, or substitute a link to a file that has not yet been submitted or processed by a...

WordPress < 3.0.3 XML-RPC Interface Access Restriction Bypass

Binary data 9112.prm...

FreeBSD : drupal -- multiple vulnerabilities (59a0af97-dbd4-11e5-8fa8-14dae9d210b8)

Drupal Security Team reports : - File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical - Brute force amplification attacks via XML-RPC XML-RPC server - Drupal 6 and 7 - Moderately Critical - Open redirect via path manipulation Base system - Drupal 6, 7...

Drupal Update Fixes 10 Vulnerabilities, One Critical

Developers at Drupal addressed 10 vulnerabilities in the content management system this week, including a critical access bypass issue that could have let users access certain elements thought to be blocked, and another issue that could lead to remote code execution. Through the critical access...

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-001

File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical A vulnerability exists in the File module that allows a malicious user to view, delete or substitute a link to a file that the victim has uploaded to a form while the form has not yet been submitted...

Brute force amplification attacks via XML-RPC

More info at https://www.drupal.org/SA-CORE-2016-001...

Brute force amplification attacks via XML-RPC

More info at https://www.drupal.org/SA-CORE-2016-001...

PHP 'PHP_to_XMLRPC_worker()' function information disclosure vulnerability

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. A security vulnerability in the PHP 'PHPtoXMLRPCworker' function allows remote attackers to exploit the vulnerability to obtain sensitive information...

Wordbrutepress - Wordpress Brute Force Multithreading with Standard and XML-RPC Login Method

Wordpress Brute Force Multithreading with standard and xml-rpc login method written in python. Features: 1. Multithreading 2. xml-rpc brute force mode 3. http and https protocols support 4. Random User Agent 5. Big wordlist support Usage: Standard login request: python wordbrutepress.py -S -t...

CVE-2015-6237 - Tripwire IP360 VnE Remote Administrative API Authentication Bypass/Privilege Acquisition Vulnerability

Document Title ================ Tripwire IP360 VnE Remote Administrative API Authentication Bypass/Privilege Acquisition Vulnerability Affected Products =================== Vendor: Tripwire Software/Appliance: IP360 VnE Vulnerability Manager Affected verified versions: v7.2.2 - v7.2.5 CVE =====...

WordPress Security: Brute Force Amplification Attack Targeting Thousand of Blogs

Most of the times, we have reported about WordPress vulnerabilities involving vulnerable plugins, but this time security researchers have discovered Brute Force Amplification attacks on the most popular CMS content management system platform. Researchers from security firm Sucuri have found a way...

Tripwire IP360 VnE Remote Administrative API Authentication Bypass Vulnerability

The IP350 VnE is susceptible to a remote XML-RPC authentication bypass vulnerability, which allows for specially crafted privileged commands to be remotely executed without authentication. The RPC service is available on the public HTTPS interface of the VnE by default, and cannot be disabled...

Z-BLOG Blind-XXE Arbitrary File Read Vulnerability

Z-Blog is developed by RainbowSoft Studio a Blog program based on the Asp platform . Z-Blog has an arbitrary file read vulnerability. /zbsystem/xml-rpc/index.php directly call simpleloadstring parsing XML, resulting in XML entity injection, an attacker can read system files using the vulnerabilit...