Zend Framework 'Zend_Feed'组件信息泄露漏洞

BUGTRAQ ID: 56982 Zend Framework ZF 是一个开放源代码的 PHP5 开发框架，可用于来开发 web 程序和服务。 Zend Framework 1.11.15、1.12.1之前版本的ZendFeedRss、ZendFeedAtom类由于使用了不安全的PHP DOM扩展，其"ZendFeed"组件在处理xml数据时存在漏洞，通过发送包含有外部实体引用的特制XML数据，攻击者可利用此漏洞打开任意文件，最终导致了本地文件信息泄露漏洞。 0 Zend Zend Framework 1.11.6 Zend Zend Framework 1.11.4 Zend Ze...

Squiz CMS - Multiple Cross-Site Scripting / XML External Entity Injection Vulnerabilities

source: https://www.securityfocus.com/bid/54049/info Squiz CMS is prone to multiple cross-site scripting vulnerabilities and an XML external entity injection vulnerability because it fails to properly sanitize user-supplied input. Attackers may exploit these issues to execute arbitrary code in th...

CVE-2012-2596

The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack...

Xxe

The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack...

CVE-2012-2596

The CVE-2012-2596 vulnerability affects Siemens WinCC 7.0 SP3 web applications, where the XPath/XML injection occurs because URL parameters do not properly filter special characters. This allows remote authenticated users to read or modify settings via a crafted URL. The issue is mitigated by app...

CVE-2012-2596

The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack...

Siemens WinCC Multiple Vulnerabilities

Overview Independent researchers Gleb Gritsai, Alexander Zaitsev, Sergey Scherbel, Yuri Goltsev, Dmitry Serebryannikov, Sergey Bobrov, Denis Baranov, Andrey Medov from Positive Technologies have identified multiple vulnerabilities in the Siemens WinCC application. In evaluating these reported...

IBM Lotus Domino Server Controller Authentication Bypass Vulnerability

Exploit for jsp platform in category remote exploits Exploit Title: IBM Lotus Domino Controller auth. bypass Date:30/11/2011 Author: Alexey Sintsov Software Link: http://www.ibm.com/ Version:8.5.3/8.5.2 FP3 0day Tested on: Windows 7 / Windows 2008 CVE : CVE-2011-1519 Application: IBM Lotus Domino...

FreeBSD : pyblosxom -- atom flavor multiple XML injection vulnerabilities (b07f3254-f83a-11dd-85a4-ea653f0746ab)

Security Focus reports : PyBlosxom is prone to multiple XML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied XML and script code would run in the context of the affected browser,...

CA Total Defense Suite reGenerateReports Stored Procedure SQL Injection

Exploit for cgi platform in category web applications $Id: catotaldefenseregeneratereports.rb 13810 2011-10-02 17:03:23Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

IceWarp Mail Server 10.3.2 server/webmail.php Soap Message Parsing - Arbitrary File Disclosure

source: https://www.securityfocus.com/bid/49753/info IceWarp Web Mail is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to gain access to potentially sensitive information, and possibly cause denial-of-service conditions; other attacks may also be...

Design/Logic Flaw

The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service parsing error and daemon pause via vectors involving 1 certain cookies in a SiteInfoLookup action to...

CVE-2011-2150

The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service parsing error and daemon pause via vectors involving 1 certain cookies in a SiteInfoLookup action to...

CVE-2011-2150

CVE-2011-2150 concerns the SmarterTools SmarterStats 6.0 web server, where the XML storage path accepts unvalidated string data. The root cause is improper validation of strings intended for XML, enabling a remote denial-of-service condition through XML parsing errors. Attack vectors include cert...

SmarterTools default basic web server vulnerabilities

Overview Multiple SmarterTools applications install a default basic web server which contains multiple vulnerabilities Description Multiple SmarterTools applications by default install a basic web server which allows administrators to start using the application immediately after installation. Th...

CVE-2011-2079

MediaCAST 8 and earlier allows remote attackers to have an unspecified impact via a 1 CPRIGHTSOURCE or 2 bdclientInventive cookie to the default URI under inventivex/managetraining/, related to an "XML injection" issue...

Design/Logic Flaw

MediaCAST 8 and earlier allows remote attackers to have an unspecified impact via a 1 CPRIGHTSOURCE or 2 bdclientInventive cookie to the default URI under inventivex/managetraining/, related to an "XML injection" issue...

CVE-2011-2079

MediaCAST 8 and earlier allows remote attackers to have an unspecified impact via a 1 CPRIGHTSOURCE or 2 bdclientInventive cookie to the default URI under inventivex/managetraining/, related to an "XML injection" issue...

CVE-2011-2079

MediaCAST 8 and earlier are affected by an XML injection vulnerability that allows remote attackers to impact the system via the default URI under inventivex/managetraining/ using either the CP_RIGHTSOURCE or bdclient_Inventive cookie. The issue is described in CVE-2011-2079 with a base CVSS v2 s...

CVE-2010-3260

oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaratio...