SAP NetWeaver AS JAVA - 'BC-BMT-BPM-DSK' XML external entity injection vulnerability

1 It is possible, that an attacker can perform a DoS attack for example, an XML Entity expansion attack 2 An SMB Relay attack is a type of man-in-the-middle attack where an attacker asks a victim to authenticate to a machine controlled by the attacker, then relays the credentials to the target. T...

CS-Cart 4.3.10 - XML External Entity Injection

Software : CS-Cart Ahmed sultan 0x4148 "; echo rawurlencodebase64encode$xml; ? change YOURHOST to your server address , use the output in the following POST request Action - HOST/cs-cart/index.php?dispatch=twigmo.post Data - action=addtocart&data=DATAOUTPUTHERE&format=xml a GET request will be se...

CS-Cart 4.3.10 - XML External Entity Injection Vulnerability

Exploit for php platform in category web applications Software : CS-Cart Ahmed sultan 0x4148 "; echo rawurlencodebase64encode$xml; ? change YOURHOST to your server address , use the output in the following POST request Action - HOST/cs-cart/index.php?dispatch=twigmo.post Data -...

Oracle BI Publisher 11.1.1.6.011.1.1.7.011.1.1.9.012.2.1.0.0 - XML External Entity Injection

Oracle BI Publisher 11.1.1.6.011.1.1.7.011.1.1.9.012.2.1.0.0 - XML External Entity Injection Exploit Title: Oracle BI Publisher formerly XML Publisher - XML External Entity Injection w/o authentication Date: 20\10\2016 Exploit Author: Jakub Palaczynski CVE : CVE-2016-3473 Vendor Homepage:...

XXE External Entity Injection Vulnerability in Hikvision Elisa Live IP camera

Hangzhou Hikvision Digital Technology Co. Elisa Live IP camera is a network camera. Hikvision Elisa Live IP camera suffers from XXE external entity injection vulnerability. An attacker can exploit the vulnerability to obtain arbitrary files on a website, and in severe cases, obtain server control...

IBM Tivoli Endpoint Manager XML External Entity Injection Vulnerability

IBM Tivoli Endpoint Manager is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Juniper Networks Junos Space Multiple Vulnerabilities (JSA10760)

Juniper Networks Junos Space is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

RSA Enterprise Compromise Assessment Tool 4.1.0.1 - XML External Entity Injection

Exploit for multiple platform in category local exploits title: XML External Entity Injection XXE product: RSA Enterprise Compromise Assessment Tool ECAT vulnerable version: 4.1.0.1 fixed version: 4.1.2.0 CVE Number: - impact: Medium homepage: https://www.rsa.com found: 2016-04-27 by: Samandeep...

RSA Enterprise Compromise Assessment Tool (ECAT) 4.1.0.1 XXE Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XML External Entity Injection XXE product: RSA Enterprise Compromise Assessment Tool ECAT vulnerable version: 4.1.0.1 fixed version: 4.1.2.0 CVE Number: - impact: Medium...

IBM Security Privileged Identity Manager Virtual Appliance Denial of Service Vulnerability

IBM Security Privileged Identity Manager is an identity management product within the IBM Identity Governance and Management solution that protects, automates, and audits the use of privileged identities to help defend against insider threats and improve security. IBM Security Privileged Identity...

PT-2016-22: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the GPL hidden content validation component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML...

PT-2016-24: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "TranslationSupport" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. H...

PT-2016-20: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "FloorPlanApp" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. How to...

PT-2016-25: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the GPL hidden content validation component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML...

PT-2016-26: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "YWorksLayouter" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. How t...

Adobe ColdFusion 11 XML External Entity Injection

============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical ============================================= I. VULNERABILITY -------------------------...

Adobe ColdFusion < 11 Update 10 - XML External Entity Injection

Exploit for php platform in category web applications ''' ============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical...

Adobe ColdFusion 11 Update 10 - XML External Entity Injection

Adobe ColdFusion 11 Update 10 - XML External Entity Injection ''' ============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical...

XML Entity Injection Vulnerability in Xinwei Software E-learning System

E-learning management system is an online learning platform of Shenzhen Xinwei Software Co. An XML entity injection vulnerability exists in the E-learning system of Xinwei Software. An attacker can use the vulnerability to remotely execute commands and gain server privileges...

IBM WebSphere Portal 8.0.0.x < 8.0.0.1 CF20 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is 8.0.0.x prior to 8.0.0.1 CF20. It is, therefore, affected by multiple vulnerabilities : - An open redirect vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit...