1267 matches found
Moderate: Red Hat Security Advisory: ruby security update
Updated ruby packages that fix an arbitrary command execution issue are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for object-oriented programming. A bug was found in the way Ruby...
[SECURITY] [DSA 746-1] New packages fix remote command execution in phpgroupware
------------------------------------------------------------------------ Debian Security Advisory DSA 746-1 [email protected] http://www.debian.org/security/ Michael Stone July 13, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...
Debian DSA-746-1 : phpgroupware - input validation error
A vulnerability had been identified in the xmlrpc library included with phpgroupware, a web-based application including email, calendar and other groupware functionality. This vulnerability could lead to the execution of arbitrary commands on the server running phpgroupware. The security team is...
Mandrake Linux Security Advisory : ruby (MDKSA-2005:118)
A vulnerability was discovered in ruby version 1.8 that could allow for the execution of arbitrary commands on a server running the ruby xmlrpc server. The updated packages have been patched to address this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...
xmlrpcGeneric.txt
I got bored last night so I wrote a basic xmlrpc exploit for metasploit. Just drop it in your exploits/ and load it up. package Msf::Exploit::xmlrpc; use strict; use base 'Msf::Exploit'; use Msf::Socket::Tcp; my $advanced = ; Exploit Information my $info = 'Name' = 'XMLRPC', 'Version' = '$Revisio...
FreeBSD : ruby -- arbitrary command execution on XMLRPC server (594eb447-e398-11d9-a8bd-000cf18bbe54)
Nobuhiro IMAI reports : the default value modification on Modulepublicinstancemethods from false to true breaks s.addhandlerXMLRPC::iPIMethods'sample', MyHandler.new style security protection. This problem could allow a remote attacker to execute arbitrary commands on XMLRPC server of libruby...
Debian DSA-747-1 : egroupware - input validation error
A vulnerability has been identified in the xmlrpc library included in the egroupware package. This vulnerability could lead to the execution of arbitrary commands on the server running egroupware. The old stable distribution woody did not include egroupware. %NASLMINLEVEL 70300 C Tenable Network...
[SECURITY] [DSA 745-1] New drupal package fixes multiple vulnerabilities
------------------------------------------------------------------------ Debian Security Advisory DSA 745-1 [email protected] http://www.debian.org/security/ Michael Stone July 10, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...
DSA-748-1 ruby1.8 - bad default value
Bulletin has no description...
xmlrpcAnti.pl.txt
Advisory : http://gulftech.org/?node=research&articleid=00088-07022005 ------------------------------------------------------- /| | | | | /\ | | / \ \ / / |\ | | / /\ \ \ | | / | | | || \ || | | | / /\ | \ || | / | | | ||/ || | || / \ | || || | / | | | || \ || | | / / \ \ | || || | / | | ||| ||...
USN-147-2: Fixed php4-pear packages for USN-147-1
USN-147-1 1 fixed a remote code execution vulnerability in the XMLRPC module of the PEAR library. Unfortunately the packages announced in USN-147-1 were faulty and shipped broken xmlrpc modules. The updated packages ship correct modules. We apologize for the inconvenience. 1...
USN-147-1: PHP XMLRPC vulnerability
A remote code execution vulnerability has been discovered in the XMLRPC module of the PEAR PHP Extension and Application Repository extension of PHP. By sending specially crafted XMLRPC requests to an affected web server, a remote attacker could exploit this to execute arbitrary code with the web...
CVE-2005-2113
SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method...
CVE-2005-2108
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file...
CVE-2005-2108
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file...
CVE-2005-2108
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file...
xmlrpc.php Library <= 1.3.0 Remote Command Execute Exploit (2)
Exploit for unknown platform in category web applications ============================================================== xmlrpc.php Library / | | | || \ || | | | / /\ | \ || | / | | | ||/ || | || / \ | || || | / | | | || \ || | | / / \ \ | || || | / | | ||| || | | / |/ | || || | | | | || /| |...
xmlrpc.php Library <= 1.3.0 Remote Command Execute Exploit (2)
No description provided by source. ------------------------------------------------------- /| | | | | /\ | | / \ \ / / |\ | | / /\ \ \ | | / | | | || \ || | | | / /\ | \ || | / | | | ||/ || | || / \ | || || | / | | | || \ || | | / / \ \ | || || | / | | ||| || | | / |/ | || || | | | | || /| |...
CVE-2005-2108
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file...
CVE-2005-2113
XOOPS <= 2.0.11 is affected by an SQL injection in the XMLRPC loginUser function that lets remote attackers execute arbitrary SQL and bypass authentication via crafted XML (e.g., blogger.getPost). The issue is documented as CVE-2005-2113; severity is HIGH (CVSS v2: AV:N/AC:L/Au:N/C:P/I:P/A:P)....