1055 matches found
PT-2013-14: XML External Entities Injection in PHP
The specialists of Positive Technologies have detected an "XXE" vulnerability in PHP. The vulnerability was detected in the PHP's built-in SoapClient and SoapServer classes. PHP allows the use of external entities while parsing SOAP wsdl files which allows an attacker to read arbitrary files. If ...
PT-2013-11: XML External Entities Injection in Oracle Siebel CRM
The specialists of the Positive Research center have detected an XML External Entities Injection vulnerability in Oracle Siebel CRM. The vulnerability is possible during import of XML files in CRM Siebel. An attacker is able to read an arbitrary file on the target system. How to fix Update your...
PT-2013-19: XML External Entities Resolution vulnerability in HP ArcSight Connector
The specialists of the Positive Research center have detected an XML External Entities Resolution vulnerability in HP ArcSight Connector. An attacker is able to import a specially crafted XML file, which would force ArcSight Connector to disclose local or remote resources to a malicious server on...
PT-2013-13: XML External Entities Injection in SAP NetWeaver
The specialists of the Positive Research center have detected an XML External Entities Injection vulnerability in SAP NetWeaver. The vulnerability was detected in the "Live Update" webdynpro application of SAP NetWeaver. The "Live Update" application located at...
PT-2013-39: Improper Input Validation in Wonderware Information Server
Positive Research Center experts have discovered "Improper Input Validation" vulnerability in Wonderware Information Server. WIS allows access to local resources files and internal resources via unsafe parsing of XML external entities. By using specially crafted XML files, an attacker can cause W...
PT-2013-72: XML External Entities Resolution vulnerability in Microsoft Office Excel
The specialists of the Positive Research center have detected an XML External Entities Resolution vulnerability in Microsoft Office Excel. The vulnerability is possible due to unsafe parsing of XML external entities. If an attacker makes a victim open a specially crafted XML document, Microsoft...
Ektron CMS 8.5.0 File Upload / XXE Injection Vulnerability
Exploit for php platform in category web applications Release Date. 05-Sep-2012 Last Update. - Vendor Notification Date. 07-May-2012 Product. Ektron CMS Platform. ASP.NET Affected versions. Ektron CMS version 8.5.0 and possibly others Severity Rating. High Impact. Exposure of sensitive informatio...
Ektron CMS 8.5.0 - Multiple Vulnerabilities
Sense of Security - Security Advisory - SOS-12-009 Release Date. 05-Sep-2012 Last Update. - Vendor Notification Date. 07-May-2012 Product. Ektron CMS Platform. ASP.NET Affected versions. Ektron CMS version 8.5.0 and possibly others Severity Rating. High Impact. Exposure of sensitive information...
XXE Injection in CakePHP and Squiz CMS
Hello! I'll give you additional information concerning advisories CakePHP 2.x-2.2.0-RC2 XXE Injection http://securityvulns.ru/docs28331.html and Squiz CMS Multiple Vulnerabilities http://securityvulns.ru/docs28220.html. It's about XXE Injection in CakePHP and Squiz CMS. Similarly to earlier...
Zend Framework - Local file disclosure via XXE injection
Hello! I'll give you additional information concerning SEC Consult Vulnerability Lab Security Advisory 20120626-0 http://securityvulns.ru/docs28331.html. This advisory was about Local file disclosure via XXE injection in Zend Framework and was talking only about Local File Disclosure attack vecto...
Debian Security Advisory DSA 2505-1 (zendframework)
The remote host is missing an update to zendframework announced via advisory DSA 2505-1. OpenVAS Vulnerability Test $Id: deb25051.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2505-1 zendframework Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft...
Debian DSA-2505-1 : zendframework - information disclosure
An XML External Entities inclusion vulnerability was discovered in Zend Framework, a PHP library. This vulnerability may allow attackers to access to local files, depending on how the framework is used. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks i...
Ubuntu: Security Advisory (USN-1480-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
RESTEasy: XML eXternal Entity (XXE) flaw
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...
Important: Red Hat Security Advisory: openoffice.org security update
Updated openoffice.org packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...
Symfony2 - Local File Disclosure
Sense of Security - Security Advisory - SOS-12-002 Release Date. 05-Mar-2012 Last Update. - Vendor Notification Date. 24-Feb-2012 Product. Symfony2 Platform. PHP Affected versions. 2.0.x - 2.0.10 Severity Rating. Medium Impact. Exposure of sensitive information Attack Vector. Remote without...
XML decoding attack vector through external entities
More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...
XML decoding attack vector through external entities
More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...
CVE-2011-1892: Exposure of Sensitive Information to an Unauthorized Actor
Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and...
CVE-2011-1280
The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express SSMSE 2005; and Visual Studio 2005 SP1, 2008 SP1, and 2010 does not properly handle external entities, which allows remote attackers to read arbitrar...