45 matches found
GHSA-QC7W-4567-84WV Zendframework vulnerable to XXE/XEE attacks
Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity XXE Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTY...
PT-2024-40427
Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description The issue concerns numerous components utilizing PHP's DOMDocument, SimpleXML, and xml parse functionality. These components are vulnerable to two types of attacks: XML eXternal Entity XXE...
PT-2024-40206
Name of the Vulnerable Software and Affected Versions: PHP affected versions not specified Description: The issue concerns components utilizing PHP's DOMDocument, SimpleXML, and xml parse functionality, which are vulnerable to two types of attacks: XML eXternal Entity XXE Injection attacks and XM...
PT-2024-40375
Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description The issue concerns numerous components utilizing PHP's DOMDocument, SimpleXML, and xml parse functionality, which are vulnerable to two types of attacks: XML eXternal Entity XXE Injection attacks...
PT-2024-40257
Name of the Vulnerable Software and Affected Versions: PHP affected versions not specified Description: The issue concerns numerous PHP components, including DOMDocument, SimpleXML, and xml parse functionality, which are vulnerable to two types of attacks: XML eXternal Entity XXE Injection attack...
PHP Interpreter File Read Write
The vulnerability of the PHP interpreter lies in the lack of checks for the sequence “%00” in the path name. Exploiting this vulnerability allows an attacker to read arbitrary files or write to them using specially crafted input data for an application that calls the DOMDocument save method or th...
Code injection
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls 1 a DOMDocument load method, 2 the xmlwriteropenuri function, 3 t...
Design/Logic Flaw
PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls 1 a DOMDocument save method or 2 the GD imagepsloadfont function...
CVE-2015-4598
PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls 1 a DOMDocument save method or 2 the GD imagepsloadfont function...
CVE-2015-3411
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls 1 a DOMDocument load method, 2 the xmlwriteropenuri function, 3 t...
CVE-2015-4598: Improper Input Validation
PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls 1 a DOMDocument save method or 2 the GD imagepsloadfont function...
Google AdWords API PHP Client Library 6.2.0 XXE Injection Vulnerability
Google AdWords API PHP client library versions 6.2.0 and below suffer from an XML eXternal Entity injection vulnerability. ============================================= - Release date: 06.11.2015 - Discovered by: Dawid Golunski - Severity: Medium/High =============================================...
Google AdWords API PHP Client Library 6.2.0 XXE Injection
Advisory URL: http://legalhackers.com/advisories/Google-AdWords-API-libraries-XXE-Injection-Vulnerability.txt ============================================= - Release date: 06.11.2015 - Discovered by: Dawid Golunski - Severity: Medium/High ============================================= I...
Zend Framework 2.4.2 / 1.12.13 XXE Injection
============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161 ============================================= I. VULNERABILITY ------------------------- Zend Framework From http://framework.zend.com/about/ website:...
Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection
Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection ============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161 ============================================= I. VULNERABILITY -------------------------...
PT-2015-3248
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.42 PHP versions 5.5.x prior to 5.5.26 PHP versions 5.6.x prior to 5.6.10 Description The issue is related to the lack of checking for %00 sequences in path names, which can be exploited by a remote attacker to read or...
Updated zabbix package fixes security vulnerability
It was reported that the Zabbix frontend supported an XML data import feature, where on the server it used DOMDocument to parse the XML. By default, DOMDocument also parses the external DTD, which could allow a remote attacker to use a crafted XML file causing Zabbix to read an arbitrary local...
MGASA-2014-0433 Updated zabbix package fixes security vulnerability
It was reported that the Zabbix frontend supported an XML data import feature, where on the server it used DOMDocument to parse the XML. By default, DOMDocument also parses the external DTD, which could allow a remote attacker to use a crafted XML file causing Zabbix to read an arbitrary local...
