exploit the possibilities
Showing 1 - 1 of 1 RSS Feed

Files

Web Service Hijacking In VMWare WebAccess
Posted Apr 1, 2010
Authored by Trustwave | Site trustwave.com

The Struts-based web application uses the server-side session sattribute "context_vmdirect" to store various settings, including the URL to the XML web service backend. By default, the URL is http://localhost/sdk, but the web service URL can be manually set from a client browser in several locations. If wsUrl is changed to point at an external server, all SOAP calls for that session are sent to the specified server. This includes plaintext authentication credentials. An attacker could exploit this by tricking a user into following a link to /ui/vmDirect.do, with an attacker-controlled server passed in the "view" parameter.

tags | advisory, web
advisories | CVE-2009-2277
MD5 | df895a7b1f99592b8cd35ccfb84a809d
Page 1 of 1
Back1Next

Top Authors In Last 30 Days

Recent News

News RSS Feed
New Simjacker Attack Exploited In The Wild To Track Users For At Least Two Years
Posted Sep 12, 2019

tags | headline, hacker, privacy, phone
Major Fraud Scheme Exposed By Insecure Database
Posted Sep 12, 2019

tags | headline, database, cybercrime, fraud
UNICEF Leaks Personal Data Of 8,000 Users Via Email Blunder
Posted Sep 12, 2019

tags | headline, privacy, email, data loss
Fin7 Operator Pleads Guilty To Two Counts
Posted Sep 12, 2019

tags | headline, malware, cybercrime, fraud
Weakness In Intel Chips Lets Researchers Steal Encrypted SSH Keystrokes
Posted Sep 11, 2019

tags | headline, privacy, flaw, password, cryptography, intel
Suspected Commonwealth Games DDoS Was Only A Fortnite Update
Posted Sep 11, 2019

tags | headline, denial of service
Secret Service Probing Breach At Federal IT Contractor
Posted Sep 11, 2019

tags | headline, hacker, government, usa
281 People Indicted In Massive Email Fraud Scheme
Posted Sep 11, 2019

tags | headline, government, email, usa, cybercrime, fraud, fbi
The Cyberwar In Yemen
Posted Sep 10, 2019

tags | headline, cyberwar, yemen
Ransomware Disrupts Illinois School District's Systems
Posted Sep 10, 2019

tags | headline, government, malware, usa, fraud, cryptography
View More News →
packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close