SAP Sybase Event Stream Processor esp_parse Remote Code Execution (CVE-2014-3457)

Two unsafe pointer dereference vulnerabilities have been reported in SAP Sybase Event Stream Processor ESP. These vulnerabilities are caused by the listening service accepting unsanitized pointers in XMLRPC requests. A remote attacker can leverage these vulnerabilities by sending crafted requests...

SAP Sybase Event Stream Processor esp_parse ConnectionType Unsafe Pointer Dereference (CVE-2014-3458)

Five unsafe pointer dereference vulnerabilities have been reported in SAP Sybase Event Stream Processor ESP. These vulnerabilities are caused by the listening service accepting unsanitized pointers in XMLRPC requests. By sending crafted requests to a vulnerable server, an remote attacker can caus...

Medium: php54

Issue Overview: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A denial of service flaw was found in the way the File Information fileinfo extension parsed certain...

Wordpress <= 1.5.1.2 xmlrpc Interface SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w sorry for the late posting, had to test it. /str0ke Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML RPC server...

PHP <= 5.3.2 xmlrpc Extension Multiple Remote Denial of Service Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/38708/info PHP's xmlrpc extension library is prone to multiple denial-of-service vulnerabilities because it fails to properly handle crafted XML-RPC requests. Exploiting these issues allows remote attackers to cause...

XOOPS <= 2.0.11 xmlrpc.php SQL Injection Exploit

No description provided by source. !/usr/bin/perl Xoops = 2.0.11 xmlrpc.php sql injection exploit by RST/GHC based on http://www.gulftech.org/?node=research&articleid=00086-06292005 coded by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru example: r57xoops.pl -u http://www.xoops2.ru/xmlrpc.php ...

Symantec Workspace Streaming Arbitrary File Upload

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include...

openSUSE Security Update : cobbler (openSUSE-SU-2012:0655-1)

The xmlrpc interface of cobbler was prone to command injectoin %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-296. The text description of this plugin is C SUSE LLC...

openSUSE Security Update : python3 (openSUSE-SU-2014:0498-1)

Python was updated to 3.3.5 fixing bugs and security issues : - bugfix-only release, closes several security bugs - CVE-2013-1752 bnc856836 - DoS flaws with unbounded reads from network - disable SSLv2 by default - DoS on maliciously crafted zip files CVE-2013-7338, bnc869222 -...

Caldera '/costview3/xmlrpc_server/xmlrpc.php' XMLRPC Request Remote Command Execution

The Caldera installation on the remote host contains a PHP script that is affected by an arbitrary command execution vulnerability. A remote, unauthenticated attacker can exploit this issue by sending a crafted XMLRPC request to the '/costview3/xmlrpcserver/xmlrpc.php' script, allowing for the...

Symantec Workspace Streaming - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'Symantec Workspace Streaming Arbitrary File Upload', 'Description' = %q This module exploits a code executio...

Symantec Workspace Streaming < 7.5 SP1 XMLRPC Request Remote Code Execution (SYM14-009)

The version of Symantec Workspace Streaming server formerly known as Altiris Streaming System installed on the remote Windows host is affected by a remote code execution vulnerability. This issue is caused by improper validation of HTTPS XMLRPC requests by the Management Agent asagent.exe...

(0Day) SAP Sybase ESP esp_parse Connection.getError Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.getError function in espserverlib.dll. By sending specific arguments t...

(0Day) SAP Sybase ESP esp_parse ConnectionType.getXmlDescription Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the ConnectionType.getXmlDescription function in espparse.exe. By sending specific...

(0Day) SAP Sybase ESP esp_parse Connection.getType Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.getType function in espserverlib.dll. By sending specific arguments to...

(0Day) SAP Sybase ESP esp_parse ConnectionType.getParamNames Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the ConnectionType.getParamNames function in espserverlib.dll. By sending specific...

(0Day) SAP Sybase ESP esp_parse Connection.setScanDepth Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.setScanDepth function in espserverlib.dll. By sending specific argumen...

(0Day) SAP Sybase ESP esp_parse Connection.getFieldNames Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.getFieldNames function in espserverlib.dll. By sending specific...

(0Day) SAP Sybase ESP esp_parse Connection.dispose Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.dispose function in espserverlib.dll. By sending specific arguments to...

(0Day) SAP Sybase ESP esp_parse Connection.reset Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.reset function in espserverlib.dll. By sending specific arguments to t...