CVE-2014-6193

IBM WebSphere Portal is affected: versions 8.0.0 through 8.0.0.1 CF14 and 8.5.0 before CF04 have the Managed Pages feature enabled, which allows remote authenticated users to write to pages via an XML injection attack. The connected sources confirm the affected product/version range and the attac...

CVE-2014-6193

IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF14 and 8.5.0 before CF04, when the Managed Pages setting is enabled, allows remote authenticated users to write to pages via an XML injection attack...

Discuz! xxe 可破坏数据库结构，导致脏数据进入

简要描述： Discuz! xxe 可破坏数据库结构，导致脏数据进入.......dz太变态了，小引号也过滤了，妹的，没办法只能分析到这里，但是隐约感觉到，这里存在很大的风险，因为改变了系统模板风格，先发个福利，大家自己看吧 详细说明： 首先我们看文件: portalcpdiy.php（lines:301-324）: if submitcheck'importsubmit' $isinner = false; $filename = ''; if$POST'importfilename' $filename =...

Drupal 6.x < 6.33 / 7.x < 7.31 XML-RPC DoS

The remote web server is running a version of Drupal that is 6.x prior to 6.33 or 7.x prior to 7.31. It is, therefore, potentially affected by multiple denial of service vulnerabilities : - The XML-RPC library in Drupal allows entity declarations without considering recursion during entity...

WordPress < 3.7.4 / 3.8.4 / 3.9.2 Multiple Vulnerabilities

According to its version number, the WordPress application hosted on the remote web server is affected by multiple vulnerabilities : - An XML injection flaw exists within 'getid3.lib.php' due to the parser accepting XML external entities from untrusted sources. Using specially crafted XML data, a...

用友人力资源管理软件SQL注入漏洞（无需登录，影响所有版本）

简要描述： 详细说明： 用友软件： 涉及客户非常多。都是大型国企、银行、能源、金融重要单位。 举例如下： 大连银行 http://zpyc.bankofdl.com 顺德农商行 http://career.sdebank.com 中国海洋石油总公司 http://zhaopin.cnooc.com.cn 北京市建筑设计研究院 www.biad.com.cn:88/ 民生银行 http://ehr.creditcard.cmbc.com.cn 中国中铁 http://61.232.6.108/ ....等等单位 直接谷歌搜 inurl:hrss/login.jsp inurl:hrss/r...

NextApp Echo < 2.1.1 XML Injection Vulnerability

No description provided by source. SEC Consult Security Advisory 20090305-0 ======================================================================== title: NextApp Echo XML Injection Vulnerability program: NextApp Echo vulnerable version: Echo2 2.1.1 homepage: http://echo.nextapp.com/site/echo2...

PyBlosxom 1.6.3 Atom Flavor Multiple XML Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/33676/info PyBlosxom is prone to multiple XML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied XML and...

smartermail 7.3 & 7.4 - Multiple Vulnerabilities

No description provided by source. Author: Hoyt LLC Research | http://xss.cx | http://cloudscan.me Identified: October 28, 2010 Vendor: SmarterTools Application: SmarterMail 7.x Bugs: Stored XSS, Reflected XSS, Directory Traversal, File Upload Parameters, OS Execution, XML Injection, LDAP...

Family Connections CMS 2.3.2 (POST) Stored XSS And XML Injection

No description provided by source. !-- Family Connections CMS 2.3.2 POST Stored XSS And XML Injection Vendor: Ryan Haudenschilt Product web page: http://www.familycms.com Affected version: 2.3.2 Summary: Family Connections is an open source content management system. It makes creating a private,...

Core Image Fun House <= 2.0 Arbitrary Code Execution PoC (OSX)

No description provided by source. !/usr/bin/ruby Copyright c Netragard, LLC. [email protected] /Developer/Applications/Graphics Tools/Core Image Fun House.app /Contents/MacOS/Core Image Fun House gdb x/10s 0xbfffddf7 0xbfffddf7: 'Z' repeats 101 times, DCBA center 2007-07-10 21:15:34.573 Core...

Remote DoS Exploit on JIRA

An attacker is able to perform the billion laughs attack on a default JIRA installation including OnDemand installations. This attack can be executed without authentication and leads to the complete use of resources on the victim machine causing the server to crash or hang. It is possible due to...

PHPYUN最新版XML注入及SQL注入获取管理员账号（无视任何防御）

简要描述： 早上提交了个XML实体读取任意文件的，结果厂商说是数字被提交了，顿时无语了。 这里还有一个XML注入及SQL注入，如果说又是数字被提交了，我保证不在挖你们的漏洞了！！！ 详细说明： 首先我们来说一说$GLOBALS"HTTPRAWPOSTDATA"这个东东，他会吧POST过来的内容原封不动的传进来，所以phpyun的那些铜墙铁壁的防御也就没用了！！！ 还是文件：weixin/model/index.class.php XML实体注入： private function responseMsg $postStr = $GLOBALS"HTTPRAWPOSTDATA"; if...

XML injection vulnerability hazard warning-vulnerability warning-the black bar safety net

Vulnerability description: the Extensible Markup Language Extensible Markup Language, XML for marking an electronic file so that it has a structural markup language that can be used to tag data definition data type is a allows the user to Own the markup language for the definition of the source...

Advantech WebAccess DBVisitor.dll ChartThemeConfig SQL Injection

This module exploits a SQL injection vulnerability found in Advantech WebAccess 7.1. The vulnerability exists in the DBVisitor.dll component, and can be abused through malicious requests to the ChartThemeConfig web service. This module can be used to extract the site and project usernames and...

Multiple vulnerabilities in JoomLeague for Joomla

Hello 3APA3A! These are Denial of Service, XML Injection, Cross-Site Scripting, Full path disclosure and Insufficient Anti-automation vulnerabilities in JoomLeague plugin for Joomla. These vulnerabilities are in Google Maps plugin for Joomla, which is used in this plugin. In 2013-2014 I wrote...

Multiple vulnerabilities in Joomla-Base

Hello 3APA3A! These are Denial of Service, XML Injection, Cross-Site Scripting, Full path disclosure and Insufficient Anti-automation vulnerabilities in Joomla-Base. This is package of Joomla with different plugins with their vulnerabilities. These vulnerabilities are in Google Maps plugin for...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Framework Kit 2.5.0 security update

An update for the seam-remoting component of Red Hat JBoss Web Framework Kit 2.5.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CV...

Code injection

Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service resource consumption via a crafted XMPP stream, aka an "xmppbomb" attack...

Joomla-Base XSS / XML Injection / Denial Of Service

Hello list! These are Denial of Service, XML Injection, Cross-Site Scripting, Full path disclosure and Insufficient Anti-automation vulnerabilities in Joomla-Base. This is package of Joomla with different plugins with their vulnerabilities. These vulnerabilities are in Google Maps plugin for...