1425 matches found
Palo Alto Networks readSessionVarsFromFile() Session Corruption
This module exploits a chain of vulnerabilities in Palo Alto Networks products running PAN-OS versions prior to 6.1.19, 7.0.19, 7.1.14, and 8.0.6. This chain starts by using an authentication bypass flaw to to exploit an XML injection issue, which is then abused to create an arbitrary directory,...
WordPress TablePress XML Injection Vulnerability
WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.TablePress is a plugin used in WordPress to create and manage tables. An XML injection vulnerability exists in WordPress...
OpenText Document Sciences xPression 4.5SP1 Patch 13 XML Injection
Title: OpenText Document Sciences xPression formerly EMC Document Sciences xPression - XML External Entity Author: Marcin Woloszyn Date: 27. September 2017 CVE: CVE-2017-14759 Affected Software: ================== OpenText Document Sciences xPression formerly EMC Document Sciences xPression Explo...
Trend Micro Control Manager ProductTree_LeftWindow XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...
Trend Micro Control Manager ProductTree_Table XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...
Foscam IP Video Camera CGIProxy.fcgi Change Username pureftpd.passwd Injection Vulnerability(CVE-2017-2850)
Summary An exploitable injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username...
Design/Logic Flaw
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugingooglemap2proxy.php...
CVE-2013-7429
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugingooglemap2proxy.php...
CVE-2013-7429
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugingooglemap2proxy.php...
CVE-2013-7429
The CVE-2013-7429 entry describes a vulnerability in the Joomla! Googlemaps plugin prior to version 3.1. The vulnerability arises from an XML injection via the url parameter to plugin_googlemap2_proxy.php, enabling remote attackers to craft malicious XML data. The affected component is the Google...
CVE-2013-7429: XML Injection (aka Blind XPath Injection)
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugingooglemap2proxy.php...
Alienvault OSSIM av-centerd Util.pm sync_rserver - Command Execution Exploit
Exploit for linux platform in category remote exploits require 'msf/core' class MetasploitModule 'Alienvault OSSIM av-centerd Util.pm syncrserver Command Execution', 'Description' = %q This module exploits a command injection vulnerability found within the syncrserver function in Util.pm. The...
DiskBoss Enterprise 8.2.14 Buffer Overflow
!/usr/bin/python Exploit Title : DiskBoss Enterprise v8.2.14 - 'Import Command' Buffer Overflow Discovery by : Anurag Srivastava Email : [email protected] Website : www.pyramidcyber.com Discovery Date : 22/08/2017 Software Link :...
XML External Entity (XXE) Injection Through Insecure Defaults
dom4j is vulnerable to XML External Entity Injection. The library by default uses the SAXReader to parse documents without using the setFeature function in it to disable doctype and entities, allowing a malicious user to pass a document to execute an XML Injection attack...
IBM Sterling B2B Integrator XML Injection Vulnerability
IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An XML external entity injection vulnerability exists in IBM...
Authentication Bypass
phpCAS is vulnerable to authentication bypasses. When authenticating against older CAS servers, a malicious user can bypass authentication by injecting xml tags into the ticket...
CVE-2015-3932: XML Injection (aka Blind XPath Injection)
Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
LogicalDoc Community Edition XXE Vulnerability
LogicalDoc CommunityEdition is a document management system developed using Java technology . The system has Lucene full-text search index and automatic import and other functions . An XML injection vulnerability exists in LogicalDoc CommunityEdition 7.5.3 and earlier versions. No details of the...
CVE-2017-10603
An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15....
CVE-2017-10603
An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15....