CVE-2017-11286

Adobe ColdFusion has an XML external entity XXE injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11...

XML Entity Injection Vulnerability in Pelco Sarix Pro Webcam import.cgi

pelco Sarix Professional is a video camera. An XML entity injection vulnerability in import.cgi in the pelco Sarix Pro webcam allows attackers to exploit the vulnerability to obtain sensitive information...

XML External Entity (XXE) Injection

slimphp is vulnerable to XML External Entity XXE Injection attacks. The library does not restrict external entities from being arbitrary loaded to when parsing XML files...

CVE-2017-1477

IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612...

Xxe

IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612...

CVE-2017-1477

IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612...

CVE-2017-1477

IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612...

CVE-2017-1477

Summary: CVE-2017-1477 affects IBM Security Access Manager Appliance 9.0.3.0, where an XML External Entity (XXE) vulnerability exists when processing XML data, potentially exposing sensitive information or exhausting memory resources. Affected product/versions (per sources): IBM Security Access M...

MacCMS suffers from xml entity injection vulnerability

MacCMS program is a fast shadow video building system that runs on PHP+MYSQL environment. MacCMS suffers from an xml entity injection vulnerability due to the system failing to disable XML entity parsing. An attacker can construct malicious requests to execute system commands on the target host t...

Mura CMS < 6.2 - Server-Side Request Forgery / XML External Entity Injection Vulnerabilities

Exploit for unknown platform in category web applications Exploit Title: Mura CMS before 6.2 SSRF + XXE Date: 30-10-2017 Exploit Author: Anthony Cole Vendor Homepage: http://www.getmura.com/ Version: before 6.2 Contact: http://twitter.com/acole76 Website: http://twitter.com/acole76 Tested on:...

Mura CMS 6.2 - Server-Side Request Forgery XML External Entity Injection

Mura CMS 6.2 - Server-Side Request Forgery XML External Entity Injection Exploit Title: Mura CMS before 6.2 SSRF + XXE Date: 30-10-2017 Exploit Author: Anthony Cole Vendor Homepage: http://www.getmura.com/ Version: before 6.2 Contact: http://twitter.com/acole76 Website: http://twitter.com/acole76...

XML External Entity Injection (XXE)

Apache axis2-idea-plugin is vulnerable to XML external entity injection XXE attacks. Attackers can inject entities through the Service XML Edit Page because the DocumentBuilderFactory allows it...

OpenText Documentum Webtop XML External Entity Injection Vulnerability

OpenText Documentum Webtop is a suite of products from OpenText Canada that allow users to access Documentum repositories and content management services in standard browser applications. An XML external entity injection vulnerability exists in OpenText Documentum Webtop version 6.8.0160.0073. A...

CVE-2017-1527

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156...

Xxe

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156...

CVE-2017-1527

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156...

CVE-2017-1527

IBM Business Process Manager (BPM) is affected by an XML External Entity (XXE) vulnerability (CVE-2017-1527). The issue stems from insufficient restriction of the XML parser when processing XML messages, potentially allowing an authenticated remote attacker to exfiltrate sensitive information or ...

Trend Micro Control Manager ProductTree_TreeManagement1 XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

IBM Infosphere Information Server / Datastage 11.5 Command Execution / Bypass

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: IBM Infosphere Information Server / Datastage vulnerable version: 9.1, 11.3, and 11.5 including Cloud version 11.5 fixed version: - CVE...

Open Fire User Import Export Plugin XML External Entity Injection(CVE-2017-2815)

Summary An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval of arbitrary files or denial of service. An authenticated attacker can send a crafted web request to trigger this vulnerability...