CVE-2022-35259: XML Injection (aka Blind XPath Injection)

XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges...

CVE-2022-27233: XML Injection (aka Blind XPath Injection)

XML injection in the QuartusR Prime Programmer included in the IntelR Quartus Prime Pro and Standard edition software may allow an unauthenticated user to potentially enable information disclosure via network access...

CVE-2022-34253: XML Injection (aka Blind XPath Injection)

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does...

CVE-2022-33739: XML Injection (aka Blind XPath Injection)

CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view the contents of any file on the system...

CVE-2022-22784: XML Injection (aka Blind XPath Injection)

The Zoom Client for Meetings for Android, iOS, Linux, MacOS, and Windows before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users clien...

CVE-2021-27777: XML Injection (aka Blind XPath Injection)

XML External Entity XXE injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references...

CVE-2022-20729: XML Injection (aka Blind XPath Injection)

A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...

CVE-2022-25356: XML Injection (aka Blind XPath Injection)

Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection...

CVE-2021-22524: XML Injection (aka Blind XPath Injection)

Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4...

CVE-2021-36028: XML Injection (aka Blind XPath Injection)

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2021-39181: XML Injection (aka Blind XPath Injection)

OpenOlat is a web-based learning management system LMS. Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file e.g. a course any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the...

CVE-2021-32758: XML Injection (aka Blind XPath Injection)

OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched...

CVE-2021-37154: XML Injection (aka Blind XPath Injection)

In ForgeRock Access Management AM before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion...

CVE-2021-2322: XML Injection (aka Blind XPath Injection)

Vulnerability in OpenGrok component: Web App. Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok. Successful attacks of this vulnerability can result in takeover of OpenGrok. CVSS 3.1...

PT-2021-7864

Name of the Vulnerable Software and Affected Versions ezXML version 0.8.6 Description The issue is related to incorrect memory handling by the ezxml parse str function when parsing crafted XML files, which can lead to writing outside a memory region created by mmap. Additionally, the vulnerabilit...

CVE-2021-21019: XML Injection (aka Blind XPath Injection)

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

CVE-2020-29599: XML Injection (aka Blind XPath Injection)

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via...

CVE-2017-15683: XML Injection (aka Blind XPath Injection)

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band...

CVE-2020-29128: XML Injection (aka Blind XPath Injection)

petl before 1.68, in some configurations, allows resolution of entities in an XML document...

CVE-2020-4774: XML Injection (aka Blind XPath Injection)

An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information su...