121 matches found
CVE-2020-25216: XML Injection (aka Blind XPath Injection)
yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet...
CVE-2020-6271: XML Injection (aka Blind XPath Injection)
SAP Solution Manager Problem Context Manager, version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the system to crash and read restricted data files visible for technical administration users of the diagnostics agent...
CVE-2020-6260: XML Injection (aka Blind XPath Injection)
SAP Solution Manager Trace Analysis, version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist...
CVE-2020-0646: XML Injection (aka Blind XPath Injection)
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'...
CVE-2014-1409: XML Injection (aka Blind XPath Injection)
MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords...
CVE-2013-4857: XML Injection (aka Blind XPath Injection)
D-Link DIR-865L has PHP File Inclusion in the router xml file...
CVE-2019-0370: XML Injection (aka Blind XPath Injection)
Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection...
CVE-2019-4539: XML Injection (aka Blind XPath Injection)
IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. IBM X-Force ID: 165812...
CVE-2019-14277: XML Injection (aka Blind XPath Injection)
Axway SecureTransport 5.x through 5.3 or 5.x through 5.5 with certain API configuration is vulnerable to unauthenticated blind XML injection and XXE in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks i.e., SSRF...
CVE-2019-9892: XML Injection (aka Blind XPath Injection)
An issue was discovered in Open Ticket Request System OTRS 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of...
CVE-2019-0268: XML Injection (aka Blind XPath Injection)
SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...
CVE-2018-19277: XML Injection (aka Blind XPath Injection)
securityScan in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file...
CVE-2018-2477: XML Injection (aka Blind XPath Injection)
Knowledge Management XMLForms in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source...
CVE-2018-16785: XML Injection (aka Blind XPath Injection)
XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...
CVE-2018-1000526: XML Injection (aka Blind XPath Injection)
Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26...
CVE-2015-3931: XML Injection (aka Blind XPath Injection)
Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
CVE-2015-3932: XML Injection (aka Blind XPath Injection)
Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
CVE-2017-10603: XML Injection (aka Blind XPath Injection)
An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15....
CVE-2017-5654: XML Injection (aka Blind XPath Injection)
In Ambari 2.4.x before 2.4.3 and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host where the Ambari server executes...