CVE-2014-8163: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5...

PT-2017-6154

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite 5 affected versions not specified Description: A directory traversal vulnerability exists in the XMLRPC interface. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

Supervisor Authenticated Remote Code Execution(CVE-2017-11610)

Vulnerability Summary The following advisory describes an authenticated remote code execution vulnerability in Supervisor version 3.1.2 and Supervisor version 3.3.2. Supervisor is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating...

Remote Code Execution (RCE)

Supervisor is vulnerable to remote code execution RCE attacks. A malicious user can send a malicious XMLRPC request to the application to inject and execute arbitrary commands at daemon level privilege...

Security Bypass

jetpack is vulnerable to security bypass. The library does not properly restrict access to it's XMLRPC functions, allowing a malicious user to view confidential information or publish posts without the proper permissions...

CVE-2016-5004

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service resource consumption by decompressing a large file containing zeroes...

CVE-2016-5004

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service resource consumption by decompressing a large file containing zeroes...

CVE-2016-5004

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service resource consumption by decompressing a large file containing zeroes...

CVE-2016-5004

CVE-2016-5004 : The vulnerability is in the Content-Encoding header handling in ws-xmlrpc 3.1.3 as used in Apache Archiva, allowing remote attackers to cause a denial of service via decompressing a large file containing zeroes. Documented details confirm the affected component and the impact on a...

CVE-2016-5004

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service resource consumption by decompressing a large file containing zeroes...

CVE-2016-5004: Uncontrolled Resource Consumption

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service resource consumption by decompressing a large file containing zeroes...

PT-2017-8644

Name of the Vulnerable Software and Affected Versions ws-xmlrpc version 3.1.3 Description The issue allows remote attackers to cause a denial of service by decompressing a large file containing zeroes, exploiting the Content-Encoding HTTP header feature. Recommendations For ws-xmlrpc version 3.1....

Drupal 7. x Service Module SQLi & RCE vulnerability analysis and EXP-vulnerability warning-the black bar safety net

Drupal 7. x Service Module SQLi & RCE In the audit of the Drupal Service module when it is detected on the unserializefunction of a insecure call. Through the vulnerability, can lead to permission to escape, SQL injection, and remote code execution. 0x00 Service Module In Drupal, the Service modu...

Drupal 7.x Services module unserialize() to RCE

Upon auditing Drupal's Services module, the Ambionics team came accross an insecure use of unserialize. The exploitation of the vulnerability allowed for privilege escalation, SQL injection and, finally, remote code execution. Services module Services is a "standardized solution for building API'...

Denial Of Service (DoS)

rpc4django is vulnerable to denial of service DoS attacks. To detect if the incoming request is XMLRPC or JSONRPC, rpc4django uses xml.dom.minidom.parseString which is vulnerable. A malicious user can create a malicious XML payload which will consume all the memory on the server...

FreeBSD : atheme-services -- multiple vulnerabilities (e47ab5db-c333-11e6-ae1b-002590263bf5)

Mitre reports : modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the 1 LIST, 2 CLEAR, or 3 MODIFY keyword nicks. Buffer overflow in the xmlrpccharencode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme...

php: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c

Integer signedness error in the simplestringaddn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other...

Ubuntu: Security Advisory (USN-3059-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS : xmlrpc-epi vulnerability (USN-3059-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3059-1 advisory. It was discovered that xmlrpc-epi incorrectly handled lengths in the simplestringaddn function. A remote attacker could use this issue to cause applications using...

USN-3059-1 xmlrpc-epi vulnerability

It was discovered that xmlrpc-epi incorrectly handled lengths in the simplestringaddn function. A remote attacker could use this issue to cause applications using xmlrpc-epi such as PHP to crash, resulting in a denial of service, or possibly execute arbitrary code...