Security Bulletin: IBM DataPower Gateways is affected by an XXE vulnerability (CVE-2018-1669)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-1669 Vulnerability Details CVEID: CVE-2018-1669 DESCRIPTION: IBM DataPower Gateways is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...

Apache Roller 5.0.3 - XML External Entity Injection (File Disclosure)

Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Exploit Title: Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Google Dork: intext:"apache roller weblogger version vulnerableversionnumber" Date: 2018-09-05 Exploit Author: Marko Jokic Contact:...

Apache Roller 5.0.3 - XML External Entity Injection Exploit

Exploit for linux platform in category web applications Exploit Title: Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Google Dork: intext:"apache roller weblogger version vulnerableversionnumber" Exploit Author: Marko Jokic Contact: http://twitter.com/MarkoJokic Vendor...

Apache Roller 5.0.3 - XML External Entity Injection (File Disclosure)

Exploit Title: Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Google Dork: intext:"apache roller weblogger version vulnerableversionnumber" Date: 2018-09-05 Exploit Author: Marko Jokic Contact: http://twitter.com/MarkoJokic Vendor Homepage: http://roller.apache.org/ Software...

CVE-2018-16252

FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection...

FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection Vulnerability

Exploit for windows platform in category web applications Title: FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection Author: hyp3rlinx Vendor: www.eventlogxp.com Software: https://eventlogxp.com/download.php Affected Component: elex.exe CVE: N/A Description: Upon opening a...

FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection

FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection Title: FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection Author: hyp3rlinx Date: 2018-09-01 Vendor: www.eventlogxp.com Software: https://eventlogxp.com/download.php Affected Component: elex.exe CVE:...

FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection

Title: FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection Author: hyp3rlinx Date: 2018-09-01 Vendor: www.eventlogxp.com Software: https://eventlogxp.com/download.php Affected Component: elex.exe CVE: N/A Description: Upon opening a specially crafted .ELX file in Event Log...

Episerver 7 patch 4 - XML External Entity Injection

Exploit Title: Episerver 7 patch 4 - XML External Entity Injection Google Dork: N/A Date: 2018-08-28 Exploit Author: Jonas Lejon Vendor Homepage: https://www.episerver.se/ Version: Episerver 7 patch 4 and below CVE : N/A episploit.py - Blind XXE file read exploit for Episerver 7 patch 4 and below...

Episerver 7 patch 4 - XML External Entity Injection

Episerver 7 patch 4 - XML External Entity Injection Exploit Title: Episerver 7 patch 4 - XML External Entity Injection Google Dork: N/A Date: 2018-08-28 Exploit Author: Jonas Lejon Vendor Homepage: https://www.episerver.se/ Version: Episerver 7 patch 4 and below CVE : N/A episploit.py - Blind XXE...

Security Bulletin: IBM FileNet Content Manager and IBM Content Foundation are affected by multiple vulnerabilities in the Administration Console for Content Platform Engine (ACCE)

Summary The IBM FileNet Content Manager and IBM Content Foundation component "Administration Console for Content Platform Engine" ACCE, is affected by multiple security vulnerabilities. Vulnerability Details Advisory CVEs: CVEID: CVE-2018-1542 DESCRIPTION: The Administration Console for Content...

CVE-2018-11048

Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance IDPA versions 2.0, 2.1 contain a XML External Entity XXE Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to...

Security Bulletin: Multiple vulnerabilities in IBM Runtime Environments Java Technology Edition, versions 6, 7, & 8 affect Transformation Extender

Summary There are multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition versions 6, 7, & 8 that are used by Transformation Extender. This issue was disclosed as part of the IBM Java SDK updates in January and April, 2017. Vulnerability Details CVEID: CVE-2016-5546...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Business Developer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 and 8 used by Rational Business Developer. These issues were disclosed as part of the IBM Java SDK updates in Apr and Jul 2017. Vulnerability Details CVEID: CVE-2017-10243 DESCRIPTION: Microsoft Office...

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML...

XML External Entity (XXE)

Jasig CAS Client is vulnerable to XML External Entity XXE injection. The attacker can trigger the attack by sending malicious XML data because it does not prevent loading malicious XML data via java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server when Google Accounts Integration is on...

FocalScope XML External Entity Injection Vulnerability

Summary An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticated attacker could submit a specially crafted web request to FocalScope’s server that could cause an XXE, and potentially result in data compromise. Tested Versions...

Microsoft Enhanced Mitigation Experience Toolkit (EMET) XML External Entity Injection Vulnerability

Microsoft Enhanced Mitigation Experience Toolkit is a security tool introduced in response to vulnerabilities. It protects users from attacks even when patches are not installed through technologies such as Data Execution Protection DEP, Structured Exception Handling Override Protection SEHOP, an...

Microsoft Enterprise Mode Site List Manager - XML External Entity Injection

Microsoft Enterprise Mode Site List Manager - XML External Entity Injection + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-ENTERPRISE-MODE-SITE-LIST-MANAGER-XXE.txt + ISR: Apparition Security Greetz:...

Microsoft Enterprise Mode Site List Manager - XML External Entity Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-ENTERPRISE-MODE-SITE-LIST-MANAGER-XXE.txt + ISR: Apparition Security Greetz: indoushka | Eduardo Vendor ============= www.microsoft Product ===========...