Design/Logic Flaw

XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service...

CVE-2016-4931

XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service...

CVE-2016-4931

CVE-2016-4931 affects Juniper Networks Junos Space prior to 15.2R2. The issue is an XML External Entity (XXE) injection in the product, allowing an attacker to trigger a denial of service. Public records consistently describe the vulnerability as an XML entity injection that can cause service dis...

Microsoft Authorization Manager 'azman' XML External Entity Injection Vulnerability

Microsoft Authorization Manager is an authorization manager from Microsoft. An XML external entity injection vulnerability exists in the Microsoft Authorization Manager V6.1.7601 'azman' module, which can be exploited by an attacker to obtain sensitive information and execute arbitrary code in th...

Juniper Networks Junos Space Multiple Vulnerabilities (JSA10760)

Juniper Networks Junos Space is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Arbitrary File Read Vulnerability in Xfire Java Web Services Engine

XFire is a new generation of Java Web services engine . Xfire Java Web Service Engine has an arbitrary file read vulnerability, which uses STAX to parse XML during invoke resulting in XML entity injection, which can be exploited by an attacker to read arbitrary files...

Z-BLOG Blind-XXE result in arbitrary file read vulnerability warning-the black bar safety net

Download the latest version of Z-Blog: http://bbs.zblogcn.com/thread-88670-1-1.html /zbsystem/xml-rpc/index.php 6 4 1 row: $zbp-Load; AddFilterPlugin'FilterPluginZbpShowError','RespondError'; $xmlstring = filegetcontents 'php://input' ; //Logs$xmlstring; $xml = simplexmlloadstring$xmlstring; The...

F5 Networks BIG-IP : XML Entity Injection vulnerabilities (K15605)

XML Entity Injection vulnerabilities have been found in the BIG-IP Configuration utility and the Enterprise Manager Configuration utility. The vulnerabilities are available to authenticated users only. CVE-2014-6032 and CVE-2014-6033 C Tenable Network Security, Inc. The descriptive text and packa...

NetIQ Access Manager 4.0 < 4.0 SP1 Hotfix 3 Multiple Vulnerabilities

The remote host is running a version of NetIQ Access Manager 4.0 without service pack 1 hotfix 3. It is, therefore, affected by the following vulnerabilities : - An XML Entity Injection XXE flaw exists in the 'query' parameter of the webacc servlet that can allow an authenticated user to view the...

McAfee ePolicy Orchestrator XML Entity Injection (CVE-2015-0921)

An XML External Entity vulnerability has been reported in McAfee ePolicy Orchestrator ePO. The vulnerability is due to an input validation error in the ePO-web application. A remote attacker can exploit this vulnerability by sending a maliciously crafted XML dashboard definition...

mcms v3.1.0 sql注入+任意文件读取。

简要描述： rt。打包 详细说明： app/weixin/notify.php $wx=new weixin; if$wx-checksignature //用于更改通知地址 ifisset$GET"echostr" die$GET"echostr"; //被动响应消息和事件 responsemsg; function responsemsg global $dbm,$C; $postStr = $GLOBALS"HTTPRAWPOSTDATA"; if!empty$postStr $postObj = simplexmlloadstring$postStr,...

Enalean Tuleap 7.2 - XXE File Disclosure

No description provided by source. Vulnerability title: Tuleap = 7.2 External XML Entity Injection in Enalean Tuleap CVE: CVE-2014-7177 Vendor: Enalean Product: Tuleap Affected version: 7.2 and earlier Fixed version: 7.4.99.5 Reported by: Jerzy Kramarz Details: A multiple XML External Entity...

Tuleap 7.2 XXE Injection

Vulnerability title: Tuleap = 7.2 External XML Entity Injection in Enalean Tuleap CVE: CVE-2014-7177 Vendor: Enalean Product: Tuleap Affected version: 7.2 and earlier Fixed version: 7.4.99.5 Reported by: Jerzy Kramarz Details: A multiple XML External Entity Injection has been found and confirmed...

SOL15605 - XML Entity Injection vulnerabilities CVE-2014-6032 and CVE-2014-6033

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

McAfee ePolicy Orchestrator < 4.6.7 HF940148 XML Entity Injection (SB10065)

The remote Windows host is running a version of McAfee ePolicy Orchestrator ePO prior to 4.6.7 hotfix 940148. It is, therefore, affected by an XML entity injection vulnerability due to a failure to properly sanitize user-supplied input. An authenticated, remote attacker with permission to add new...

Symantec Endpoint Protection Manager Vulnerabilities

SUMMARY The management console for Symantec Endpoint Protection Manager does not properly handle external XML data, which could potentially allow unauthorized access to restricted server-side data and console management functionality. The management console for Symantec Endpoint Protection Manage...

Sybase EAServer 6.3.1 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Sybase EAServer vulnerable version: =6.3.1 fixed version: vendor did not supply version information CVE number: - impact: critical...

SEC Consult SA-20130719-0 :: Multiple vulnerabilities in Sybase EAServer

SEC Consult Vulnerability Lab Security Advisory 20130719-0 ======================================================================= title: Multiple vulnerabilities product: Sybase EAServer vulnerable version: =6.3.1 fixed version: vendor did not supply version information CVE number: - impact:...

Sybase EAServer 6.3.1 Multiple Vulnerabilities

Sybase EAServer versions 6.3.1 and below suffer from directory traversal, XML entity injection, and OS command execution vulnerabilities. title: Multiple vulnerabilities product: Sybase EAServer vulnerable version: =6.3.1 fixed version: vendor did not supply version information CVE number: -...

Sybase EAServer 6.3.1 Directory Traversal / XXE Injection / Command Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Sybase EAServer vulnerable version: =6.3.1 fixed version: vendor did not supply version information CVE number: - impact: critical...