1168 matches found
Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection Vulnerability
Exploit for windows platform in category web applications Exploit Title: Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Venodor: www.microsoft.com Software: SQL Server Management Studio 17.9 and SQL...
Microsoft SQL Server Management Studio 17.9 / 18.0 Preview 4 XML Injection
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-XMLA-FILETYPE-XML-INJECTION-CVE-2018-8532.txt + ISR: ApparitionSec + Zero Day Initiative Program Vendor www.microsoft.com Product SQL Server...
Microsoft SQL Server Management Studio 17.9 / 18.0 Preview 4 XML Injection
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-XEL-FILETYPE-XML-INJECTION-CVE-2018-8527.txt + ISR: ApparitionSec + Zero Day Initiative Program Vendor www.microsoft.com Product SQL Server...
openSUSE Security Update : dom4j (openSUSE-2018-1077)
This update for dom4j fixes the following issues : - CVE-2018-1000632: Prevent XML injection vulnerability that allowed an attacker to tamper with XML documents bsc1105443 This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
Security Bulletin: A Security vulnerability in IBM Java SDK affects IBM Tivoli System Automation for Multiplatforms (CVE-2017-1289).
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 used by IBM Tivoli System Automation for Multiplatforms. IBM Tivoli System Automation for Multiplatforms has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-1289 DESCRIPTION: IBM SDK, Ja...
CVE-2018-1702
IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM...
Security update for dom4j (moderate)
This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection vulnerability that allowed an attacker to tamper with XML documents bsc1105443 This update was imported from the SUSE:SLE-12:Update update project...
iWay Data Quality Suite Web Console 10.6.1.ga XML Injection
Exploit Title: iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20 a XML External Entity Injection Google Dork: N/A Date: 2018-09-27 Exploit Author: Sureshbabu Narvaneni Author Blog : https://nullnews.in Vendor Homepage: www.informationbuilders.co.uk Software Link:...
CVE-2018-1669
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...
SUSE-SU-2018:2861-1 Security update for dom4j
This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection vulnerability that allowed an attacker to tamper with XML documents bsc1105443...
SUSE-SU-2018:2863-1 Security update for dom4j
This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection vulnerability that allowed an attacker to tamper with XML documents bsc1105443...
Debian DLA-1517-1 : dom4j security update
Mario Areias discovered that dom4j, a XML framework for Java, was vulnerable to a XML injection attack. An attacker able to specify attributes or elements in the XML document might be able to modify the whole XML document. For Debian 8 'Jessie', this problem has been fixed in version...
Debian: Security Advisory (DLA-1517-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Design/Logic Flaw
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...
CVE-2018-16784
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...
CVE-2018-16784
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...
CVE-2018-16784
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...
CVE-2018-16784
CVE-2018-16784 concerns DedeCMS 5.7 SP2, where an XML injection allows remote code execution via a crafted substring "<file type='file' name='../". The connected documents provide the vulnerability description and NVD metrics, indicating network access with low complexity and partial to high i...