Xxe

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

CVE-2016-5851

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

CVE-2016-5851

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

PYSEC-2016-21

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

PYSEC-2016-21

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

CVE-2016-5851

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

PT-2016-6716 · Python · Python-Docx

Name of the Vulnerable Software and Affected Versions: python-docx versions prior to 0.8.6 Description: The issue allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document. This can be exploited by providing a specially crafted document to the python-doc...

CVE-2016-5851

python-docx before 0.8.6 is vulnerable to XML External Entity (XXE) attacks via a crafted Word document. The issue affects the python-docx library and is resolved by upgrading to 0.8.6 or later. The provided sources confirm the flaw and its remediation path; no exploitation details are included i...

Hand to hand teach you how to construct the office exploits EXP（fourth period）-bug warning-the black bar safety net

This is a period of vulnerability to share with you is CVE-2015-1641 learning summary, this vulnerability due to its good versatility and stability claims to have replaced the CVE-2012-0158 trend. The vulnerability is a type confusion class of vulnerability, through which you can achieve arbitrar...

SSL Enabled Basic Auth Credential Harvester: phishery

An SSL Enabled Basic Auth Credential Harvester with a Word Document Template URL Injector Phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication. Phishery also provides the ability easily to inject the URL into a .docx Word document...

python-docx XML External Entity Vulnerability

python-docx is a python library for editing and generating Microsoft Word documents. An XML external entity vulnerability exists in python-docx version 0.8.5. An attacker can exploit this vulnerability to conduct an XML external entity attack...

Docx Reader : Docx to PDF - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Docx Reader : Docx to PDF published at the 'play' market has multiple vulnerabilities...

Basic docx Reader - External URLs, Unsafe deleting, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application Basic docx Reader published at the 'play' market has multiple vulnerabilities...

Hewlett-Packard KeyView IDOL DOCX Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard KeyView IDOL. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the handling...

Fedora 21 : libreoffice-4.3.7.2-3.fc21 (2015-7022)

Fix some .docx import crashes. And finally fix the re-render of checked-unchecked checkbox transition update to 4.3.7 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and forma...

Oracle - Outside-In .DOCX File Parsing Memory Corruption

Oracle - Outside-In .DOCX File Parsing Memory Corruption Title: Oracle Outside-In DOCX File Parsing Memory Corruption Platforms: Windows CVE: Secunia: PRL: 2015-04 Author: Francis Provencher Protek Research Lab’s Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2...

Oracle - Outside-In '.DOCX' File Parsing Memory Corruption

Title: Oracle Outside-In DOCX File Parsing Memory Corruption Platforms: Windows CVE: Secunia: PRL: 2015-04 Author: Francis Provencher Protek Research Lab’s Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2 Report Timeline 3 Technical details 4 POC ==============...

Microsoft Word Format Tag Transposition Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Word. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of th...

[SECURITY] Fedora 20 Update: apache-poi-3.10.1-2.fc20

The Apache POI Project's mission is to create and maintain Java APIs for manipulating various file formats based upon the Office Open XML standards OOXML and Microsoft's OLE 2 Compound Document format OLE2. In short, you can read and write MS Excel files using Java. In addition, you can read and...

Facebook Careers Page XXE Vulnerability Patched

A vulnerability was discovered and patched in a third-party service that handles resumes on Facebook’s careers page. The discovery was worth more than $6,000 in a bounty paid out by Facebook to researcher Mohamed Ramadan of Egypt, who published some details of the vulnerability and exploit on his...