CVE-2011-4588

CVE-2011-4588 affects Moodle 1.9.x prior to 1.9.15. The ip_in_range function in mnet/lib.php (MNET) uses an incorrect data type, enabling remote attackers to bypass IP address restrictions via an XMLRPC request. Connected sources confirm Moodle/MNET context and version window; Debian/OpenVAS advi...

PT-2012-1920 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 1.9.x through 1.9.14 Description: The issue concerns the ip in range function in mnet/lib.php, which incorrectly handles data types. This allows remote attackers to bypass intended IP address restrictions by sending an XMLRPC...

The zend framework xxe injection analysis-vulnerability warning-the black bar safety net

A few days ago online broke a zend framework vulnerability author: mkods Specifically described as follows: ; according to the description, the vulnerability occurs in the zend Framework xmlrpc module of an xxeXML external entity injection vulnerability this vulnerability can be read on server...

CVE-2011-4302

mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the opensslverify function, which allows remote attackers to bypass validation via a crafted certificate...

CVE-2011-4302

Moodle vulnerability CVE-2011-4302 affects MNET in Moodle: 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2. The issue is improper processing of the return value from openssl_verify in mnet/xmlrpc/client.php, allowing remote attackers to bypass certificate validation with a crafted...

PT-2012-1850 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 1.9.x through 1.9.13 Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1 Description: The issue arises from improper processing of the return value of the openssl verify function in mnet/xmlrpc/client.php...

AZL-45093 CVE-2012-1147 affecting package xmlrpc-c 1.60.04-4

readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service file descriptor consumption via a large number of crafted XML files...

WordPress information leakage and illegal operation vulnerability-vulnerability warning-the black bar safety net

Affected system: WordPress WordPress 3. x Description: -------------------------------------------------------------------------------- WordPress is a PHP language and MySQL database development Blog（blog, blogengine, users can support PHP and MySQL database server on build your own Blog...

WordPress 3.x 信息泄露及非法操作漏洞

WordPress是一种使用PHP语言和MySQL数据库开发的Blog（博客、网志引擎，用户可以在支持PHP和MySQL数据库的服务器上建立自己的Blog。 WordPress 3.4.1之前版本在处理XMLRPC请求时对用户检查过程中存在错误，可导致信息泄露和非法编辑公告操作。 0 WordPress 3.x 厂商补丁： WordPress --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://wordpress.org/...

Zend Framework Local File Disclosure

No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20120626-0 ======================================================================= title: Local file disclosure via XXE injection product: Zend Framework vulnerable version: 1.11.11 1.12.0 RC1 2.0.0 beta4 and earli...

Zend Framework < 2.0.0 beta4 < 1.12 RC1 < 1.11.11 - Local File Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local file disclosure via XXE injection product: Zend Framework vulnerable version: 1.11.11 1.12.0 RC1 2.0.0 beta4 and earlier versions / branches fixed version: 1.11.12...

Zend Framework XXE Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local file disclosure via XXE injection product: Zend Framework vulnerable version: 1.11.11 1.12.0 RC1 2.0.0 beta4 and earlier versions / branches fixed version: 1.11.12...

Zend Framework -- Multiple vulnerabilities via XXE injection

The Zend Framework team reports: The XmlRpc package of Zend Framework is vulnerable to XML eXternal Entity Injection attacks both server and client. The SimpleXMLElement class SimpleXML PHP extension is used in an insecure way to parse XML data. External entities can be specified by adding a...

python: SimpleXMLRPCServer CPU usage DoS via malformed XML-RPC request

SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service infinite loop and CPU consumption via an XML-RPC POST request that contains a smaller amount of data than specified...

CVE-2012-2395

Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...

CVE-2012-2395

Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...

UBUNTU-CVE-2012-2395

Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...

Input validation

Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...

CVE-2012-2395

CVE-2012-2395 corresponds to a command-injection flaw in Cobbler's XML-RPC power_system API (action_power.py). The root cause is an incomplete blacklist allowing shell metacharacters in the username or password fields, enabling remote command execution. The CVE affected Cobbler 2.2.0, with a NVD ...

CVE-2012-2395

Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...