Design/Logic Flaw

IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks via unspecified vectors...

CVE-2016-2932

IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks via unspecified vectors...

CVE-2016-2932

IBM BigFix Remote Control before 9.1.3 is affected by an XML injection vulnerability (CVE-2016-2932) due to an unspecified flaw that allows an unauthenticated, remote attacker to inject arbitrary XML content. Public documents do not provide exploitation details; one source suggests upgrading to 9...

CVE-2016-6461

A vulnerability in the HTTP web-based management interface of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to inject arbitrary XML commands on the affected system. More Information: CSCva38556. Known Affected Releases: 9.16.10. Known Fixed Releases:...

CS-Cart 4.3.10 - XML External Entity Injection

CS-Cart 4.3.10 - XML External Entity Injection Software : CS-Cart Ahmed sultan 0x4148 "; echo rawurlencodebase64encode$xml; ? change YOURHOST to your server address , use the output in the following POST request Action - HOST/cs-cart/index.php?dispatch=twigmo.post Data -...

PT-2016-6933 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA version 9.16.10 Description: A vulnerability in the HTTP web-based management interface could allow an unauthenticated, remote attacker to inject arbitrary XML commands on the affected system...

Trend Micro Control Manager 6.x < 6.0 SP3 Hotfix 3328 Multiple Vulnerabilities

According to its version, the Trend Micro Control Manager application installed on the remote Windows host is 6.x prior to 6.0 SP 3 Hotfix 3328 6.0.0.3328. It is, therefore, affected by the following vulnerabilities : - A directory traversal vulnerability exists in the taskcontroller.php script d...

WSO2 Identity Server 5.1.0 XML Injection

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product: ============================ Wso2 Identity Server v5.1.0...

MediaWiki < 1.19.24 / 1.23.9 / 1.24.2 Multiple Vulnerabilities

Binary data 9471.prm...

欧朋一处blind xxe利用Cloudeye神器测试

简要描述： 突然想用一用买的Cloudeye 于是就找到了 详细说明： 漏洞地址 http://notify.oupeng.com/notify post数据 %remote; 可以在cloudeye 中看见访问记录 试下file协议 用不了 发出来 大家看一下吧 漏洞证明： 漏洞地址 http://notify.oupeng.com/notify post数据 %remote; 可以在cloudeye 中看见访问记录 https://images.seebug.org/upload/201606/132016543555eb5d39...

Paessler PRTG Network Monitor 14.4.12.3282 XXE Injection

Advisory: XML External Entity Expansion in Paessler PRTG Network Monitor Authenticated users who can create new HTTP XML/REST Value sensors in PRTG Network Monitor can read local files on the PRTG host system via XML external entity expansion. Details ======= Product: Paessler PRTG Network Monito...

SUSE-SU-2016:1310-1 Security update for php53

This update for php53 fixes the following security issues: - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mbstrcut bsc977003 - CVE-2015-8867: The PHP function...

PHP 7.0.x < 7.0.6 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.6. It is, therefore, affected by multiple vulnerabilities : - A signedness error exists in the GD Graphics library within file gdgd2.c due to improper validation of user-supplied input when handling...

mallbuilder多用户商城系统 v5.8.1.1 /api/wechat.php XML注入漏洞

No description provided by source...

VMware vCenter Multiple Vulnerabilities (VMSA-2015-0008)

The VMware vCenter Server installed on the remote host is affected by the following vulnerabilities : - An XML external entity XXE injection flaw exists in Flex BlazeDS in the file flex-messaging-core.jar due to an incorrectly configured XML parser accepting XML external entities from untrusted...

WordPress < 3.7.4 / 3.8.x < 3.8.4 / 3.9.x < 3.9.2 Multiple Vulnerabilities

Binary data 9025.prm...

jenkins: multiple issues

CVE-2015-5317 information leakage The Jenkins UI allowed users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages if those shared file fingerprints with fingerprinted files in accessible jobs. - CVE-2015-5318 cross-side request forgery The salt used to...

Apache ActiveMQ 5.x < 5.10.1 Multiple Vulnerabilities

Binary data 8961.prm...

Bosch Security Systems Dinion NBN-498 XML Injection

Exploit Title: Bosch Security Systems - XML Injection - Dinion NBN-498 Web Interface Date: 01/09/2015 Exploit Author: neom22 Vendor Homepage: http://us.boschsecurity.com Data Sheet: http://resource.boschsecurity.us/documents/DatasheetenUS9007201286798987.pdf Version: Hardware Firmware 4.54.0026 -...

Bosch Security Systems Dinion NBN-498 Web Interface - XML Injection Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Bosch Security Systems - XML Injection - Dinion NBN-498 Web Interface Date: 01/09/2015 Exploit Author: neom22 Vendor Homepage: http://us.boschsecurity.com Data Sheet:...