Palo Alto Networks Firewalls Remote Root Code Execution Vulnerability

Three separate bugs can be used together to remotely execute commands as root through the web management interface without authentication on PAN-OS versions 6.1.18 and earlier, PAN-OS versions 7.0.18 and earlier, PAN-OS versions 7.1.13 and earlier, and PAN-OS versions 8.0.5 and earlier. Full...

Palo Alto Networks Firewalls Remote Root Code Execution

Hello, This is a public advisory for CVE-2017-15944 which is a remote root code execution bug in Palo Alto Networks firewalls. Three separate bugs can be used together to remotely execute commands as root through the web management interface without authentication on: PAN-OS 6.1.18 and earlier,...

WordPress TablePress XML Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.TablePress is a plugin used in WordPress to create and manage tables. An XML injection vulnerability exists in WordPress...

OpenText Document Sciences xPression 4.5SP1 Patch 13 XML Injection

Title: OpenText Document Sciences xPression formerly EMC Document Sciences xPression - XML External Entity Author: Marcin Woloszyn Date: 27. September 2017 CVE: CVE-2017-14759 Affected Software: ================== OpenText Document Sciences xPression formerly EMC Document Sciences xPression Explo...

Trend Micro Control Manager ProductTree_LeftWindow XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

Trend Micro Control Manager ProductTree_Table XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

Foscam IP Video Camera CGIProxy.fcgi Change Username pureftpd.passwd Injection Vulnerability(CVE-2017-2850)

Summary An exploitable injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username...

Design/Logic Flaw

The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugingooglemap2proxy.php...

CVE-2013-7429

The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugingooglemap2proxy.php...

CVE-2013-7429

The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugingooglemap2proxy.php...

CVE-2013-7429

The CVE-2013-7429 entry describes a vulnerability in the Joomla! Googlemaps plugin prior to version 3.1. The vulnerability arises from an XML injection via the url parameter to plugin_googlemap2_proxy.php, enabling remote attackers to craft malicious XML data. The affected component is the Google...

Alienvault OSSIM av-centerd Util.pm sync_rserver - Command Execution Exploit

Exploit for linux platform in category remote exploits require 'msf/core' class MetasploitModule 'Alienvault OSSIM av-centerd Util.pm syncrserver Command Execution', 'Description' = %q This module exploits a command injection vulnerability found within the syncrserver function in Util.pm. The...

DiskBoss Enterprise 8.2.14 Buffer Overflow

!/usr/bin/python Exploit Title : DiskBoss Enterprise v8.2.14 - 'Import Command' Buffer Overflow Discovery by : Anurag Srivastava Email : [email protected] Website : www.pyramidcyber.com Discovery Date : 22/08/2017 Software Link :...

XML External Entity (XXE) Injection Through Insecure Defaults

dom4j is vulnerable to XML External Entity Injection. The library by default uses the SAXReader to parse documents without using the setFeature function in it to disable doctype and entities, allowing a malicious user to pass a document to execute an XML Injection attack...

IBM Sterling B2B Integrator XML Injection Vulnerability

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An XML external entity injection vulnerability exists in IBM...

Authentication Bypass

phpCAS is vulnerable to authentication bypasses. When authenticating against older CAS servers, a malicious user can bypass authentication by injecting xml tags into the ticket...

LogicalDoc Community Edition XXE Vulnerability

LogicalDoc CommunityEdition is a document management system developed using Java technology . The system has Lucene full-text search index and automatic import and other functions . An XML injection vulnerability exists in LogicalDoc CommunityEdition 7.5.3 and earlier versions. No details of the...

CVE-2017-10603

An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15....

CVE-2017-10603

An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15....

Design/Logic Flaw

An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15....