RSA Authentication Manager 8.2.1.4.0-build1394922 8.3 P1 - XML External Entity Injection Cross-Site Flashing DOM Cross-Site Scripting

RSA Authentication Manager 8.2.1.4.0-build1394922 8.3 P1 - XML External Entity Injection Cross-Site Flashing DOM Cross-Site Scripting SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XXE & XSS vulnerabilities product: R...

CVE-2017-2815

An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval of arbitrary files or denial of service. An authenticated attacker can send a crafted web request to trigger this vulnerability...

Design/Logic Flaw

An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval of arbitrary files or denial of service. An authenticated attacker can send a crafted web request to trigger this vulnerability...

CVE-2017-2815

An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval of arbitrary files or denial of service. An authenticated attacker can send a crafted web request to trigger this vulnerability...

CVE-2017-2815

OpenFire User Import Export Plugin 2.6.0 is vulnerable to XML External Entity (XXE) injection (CVE-2017-2815). An authenticated attacker can send a crafted request to trigger XXE, enabling retrieval of arbitrary files or causing a Denial of Service. Affected component: OpenFire User Import Export...

ModbusPal XML External Entity Injection Vulnerability

ModbusPal is a MODBUS simulator written in Java with a replicated MODBUS environment. An XML external entity injection vulnerability exists in ModbusPal version 1.6b. A remote attacker can exploit this vulnerability by sending a specially crafted .xmpp or .xmpa file to the user to obtain the...

ModbusPal 1.6b - XML External Entity Injection

ModbusPal 1.6b - XML External Entity Injection + Exploit Title: ModbusPal XXE Injection + Date: 05-08-2018 + Exploit Author: Trent Gordon + Vendor Homepage: http://modbuspal.sourceforge.net/ + Software Link: https://sourceforge.net/projects/modbuspal/files/latest/download?source=files + Version:...

Eclipse IDE Eclipse XML Parser External Entity Injection Vulnerability

Eclipse IDE is the Eclipse Foundation's set of integrated development environment . Eclipse XML parser is one of the XML parser . A security vulnerability exists in the Eclipse XML parser in Eclipse IDE 2017.2.5 and earlier versions. An attacker can exploit this vulnerability to perform an XML...

IBM Rational ClearCase Multiple Component XML External Entity Injection Vulnerability

IBM Rational ClearCase is a software configuration management solution from IBM in the United States. The solution provides version control, workspace management, parallel development support and build auditing, etc. CCRC WAN Server/CM Server, etc. are components used in it. An XML external entit...

KYOCERA Multi-Set Template Editor 3.4 - Out-Of-Band XML External Entity Injection

KYOCERA Multi-Set Template Editor 3.4 - Out-Of-Band XML External Entity Injection Vendor: KYOCERA Corporation Product https://global.kyocera.com Affected version: 3.4.0906 Summary: KYOCERA Net Admin is Kyocera's unified device management software that uses a web-based platform to give network...

CVE-2018-1421

IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139023...

Xxe

IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139023...

Microsoft Windows Remote Assistance - XML External Entity Injection Vulnerability

Exploit for windows platform in category web applications Exploit Title: Microsoft Windows Remote Assistance XXE Date: 27/03/2018 Exploit Author: Nabeel Ahmed Tested on: Windows 7 x64, Windows 10 x64 CVE : CVE-2018-0878 Category: Remote Exploits Invitation.msrcincident ------------------------...

Red Hat Spacewalk XML External Entity Injection Vulnerability

Red Hat Spacewalk is the United States Red Hat Red Hat, Inc. based on the Red Hat Network Satellite a set of system management platform and the development of open source Linux system management solutions. The solution provides statistical system information, install and update software, collect...

Microsoft Windows Remote Assistance - XML External Entity Injection

Microsoft Windows Remote Assistance - XML External Entity Injection Exploit Title: Microsoft Windows Remote Assistance XXE Date: 27/03/2018 Exploit Author: Nabeel Ahmed Tested on: Windows 7 x64, Windows 10 x64 CVE : CVE-2018-0878 Category: Remote Exploits Invitation.msrcincident...

Microsoft Windows Remote Assistance - XML External Entity Injection

Exploit Title: Microsoft Windows Remote Assistance XXE Date: 27/03/2018 Exploit Author: Nabeel Ahmed Tested on: Windows 7 x64, Windows 10 x64 CVE : CVE-2018-0878 Category: Remote Exploits Invitation.msrcincident ------------------------ /xxe.xml" %remote;%root;%oob; xxe.xml ----------------------...

xml entity injection vulnerability in CLTPHP version 5.5.3

CLTPHP is a content management system developed in ThinkPHP with the Layui framework in the backend. CLTPHP version 5.5.3 has an XML entity injection vulnerability in the program implementation, which can be exploited by attackers to read arbitrary files, execute system commands, probe intranet...

CVE-2018-6225

An XML external entity injection XXE vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenticated user to expose a normally protected configuration script...

XML External Entity Injection in Jive-n (CVE-2018-5758)

The post XML External Entity Injection in Jive-n CVE-2018-5758 appeared first on Rhino Security Labs...

Schneider Electric Pelco Sarix Professional Web interface component XML entity injection vulnerability

Schneider Electric Pelco Sarix Professional is a video surveillance device from Schneider Electric, France.Web interface is one of the web management interfaces. An XML entity injection vulnerability exists in the import.cgi file of the Web interface component in the Schneider Electric Pelco Sari...