PT-2016-24: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "TranslationSupport" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. H...

PT-2016-20: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "FloorPlanApp" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. How to...

PT-2016-22: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the GPL hidden content validation component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML...

PT-2016-26: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "YWorksLayouter" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. How t...

PT-2016-25: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the GPL hidden content validation component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML...

Adobe ColdFusion 11 XML External Entity Injection

============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical ============================================= I. VULNERABILITY -------------------------...

Adobe ColdFusion < 11 Update 10 - XML External Entity Injection

Exploit for php platform in category web applications ''' ============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical...

Adobe ColdFusion 11 Update 10 - XML External Entity Injection

Adobe ColdFusion 11 Update 10 - XML External Entity Injection ''' ============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical...

IBM WebSphere Portal 8.0.0.x < 8.0.0.1 CF20 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is 8.0.0.x prior to 8.0.0.1 CF20. It is, therefore, affected by multiple vulnerabilities : - An open redirect vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit...

IBM Traveler XML External Entity Injection Vulnerability

IBM Traveler is a free suite of push email software from IBM in the United States. An XML external entity injection vulnerability exists in IBM Traveler, which can be exploited by a remote attacker to read arbitrary files or cause a denial of service memory consumption with the help of XML data...

WSO2 SOA Enablement Server XML External Entity Injection

Title: WSO2 SOA Enablement Server - XML External Entity Injection Authors: Pawel Gocyla, Jakub Palaczynski Date: 08. June 2016 Affected Software: ================== WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 Probably other versions are also vulnerable. Vulnerability: XML...

QlikView Server AccessPoint XML External Entity Injection

The version of QlikView Server running on the remote host is 11.20 prior to 11.20 SR12. It is, therefore, affected by an XML external entity XXE injection vulnerability, specifically DTD parameter injection, in the /AccessPoint.aspx script due to an incorrectly configured XML parser accepting XML...

SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1310-1)

This update for php53 fixes the following security issues : - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mbstrcut bsc977003 - CVE-2015-8867: The PHP function...

IBM Security AppScan Enterprise and IBM Security AppScan Standard XML External Entity Injection Vulnerability

IBM Security AppScan Enterprise and IBM Security AppScan Standard are both Web application security testing solutions from IBM USA. The solutions support simultaneous scanning of multiple Web applications, generating vulnerability reports and intelligent patching. IBM Security AppScan Enterprise...

Tenable Nessus 6.0.x < 6.6 Multiple Vulnerabilities

According to its self-reported version, the Tenable Nessus application running on the remote host is 6.x prior to 6.6. It is, therefore, affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input. An authenticated,...

HP Operations Manager i Apache Flex BlazeDS External Entity Injection Vulnerability

The remote HP Operations Manager i host is affected by an XML external entity XXE vulnerability in the bundled version of Apache Flex BlazeDS due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. A remote attacker can exploit this, via a specially...

IBM WebSphere Application Server Multiple Vulnerabilities (swg21690185, swg21671835)

IBM WebSphere Application Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

IBM WebSphere Application Server Information Disclosure Vulnerability (swg21671835)

IBM WebSphere Application Server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Damn Vulnerable Web Services: DVWS

Damn Vulnerable Web Services is a vulnerable testing environment that can be used to learn real world web service vulnerabilities. The aim of this project is to aid security professionals in testing their skills and tools in a legal environment. This application is designed to understand the...

SolarWinds Log and Event Manager XML External Entity Injection Vulnerability

SolarWinds Log and Event Manager LEM is vulnerable to an Extensible Markup Language XML external entity injection SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...