SUSE-SU-2018:2861-1 Security update for dom4j

This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection vulnerability that allowed an attacker to tamper with XML documents bsc1105443...

SUSE-SU-2018:2863-1 Security update for dom4j

This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection vulnerability that allowed an attacker to tamper with XML documents bsc1105443...

Debian DLA-1517-1 : dom4j security update

Mario Areias discovered that dom4j, a XML framework for Java, was vulnerable to a XML injection attack. An attacker able to specify attributes or elements in the XML document might be able to modify the whole XML document. For Debian 8 'Jessie', this problem has been fixed in version...

Debian: Security Advisory (DLA-1517-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-16784

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

CVE-2018-16784

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

Design/Logic Flaw

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

CVE-2018-16784

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

CVE-2018-16784

CVE-2018-16784 concerns DedeCMS 5.7 SP2, where an XML injection allows remote code execution via a crafted substring "<file type='file' name='../". The connected documents provide the vulnerability description and NVD metrics, indicating network access with low complexity and partial to high i...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

Design/Logic Flaw

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

The connected sources confirm a concrete vulnerability in DedeCMS v5.7 SP2 (PHP-based CMS): a file-write flaw that attackers can exploit to write a script file and obtain a webshell. This CVE (CVE-2018-16785) is described as affecting DedeCMS 5.7 SP2 with XML injection/file-write mechanics enabli...

Code injection

SAP HANA versions 1.0 and 2.0 Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, an unauthorized hacker can cause the database server to crash...

Microsoft Baseline Security Analyzer 2.3 XML Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-BASELINE-ANALYZER-v2.3-XML-INJECTION.txt + ISR: Apparition Security + Zero Day Initiative Program Vendor www.microsoft.com Product Microsoft Baseline Security...

Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection

Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection Title: Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection Date: 2018-09-08 Author: John Page aka hyp3rlinx Vendor: Microsoft Software link: https://www.microsoft.com/en-us/download/details.aspx?id=7558...

Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection

Title: Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection Date: 2018-09-08 Author: John Page aka hyp3rlinx Vendor: Microsoft Software link: https://www.microsoft.com/en-us/download/details.aspx?id=7558 Software Version: 2.3 References: ZDI-CAN-6307 References:...

Apache Roller 5.0.3 XML Injection / File Disclosure

Exploit Title: Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Google Dork: intext:"apache roller weblogger version vulnerableversionnumber" Date: 2018-09-05 Exploit Author: Marko Jokic Contact: http://twitter.com/MarkoJokic Vendor Homepage: http://roller.apache.org/ Software...

FsPro Labs Event Log Explorer 4.6.1.2115 XML Injection

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FSPRO-LABS-EVENT-LOG-EXPLORER-XML-INJECTION-INFO-DISCLOSURE.txt + ISR: ApparitionSec Greetz: Greetz: indoushka | Eduardo Vendor www.eventlogxp.com Product Event Log Explorer v4.6.1.2115...