54734 matches found
Oracle Business Intelligence - Path Traversal
Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...
IBM Maximo Asset Management Information Disclosure - XML External Entity Injection
IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...
WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection
WSO2 API Manager 3.1.0 and earlier is vulnerable to blind XML external entity injection XXE. XXE often allows an attacker to view files on the server file system, and to interact with any backend or external systems that the application itself can access which allows the attacker to transmit...
Apache OFBiz - XML External Entity Injection
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figur...
Oracle Business Intelligence Publisher - XML External Entity Injection
Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publishe...
FreeIPA - XML Entity Injection
Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. id: CVE-2022-2414 info: name: FreeIPA - XML Entity Injection...
Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass
Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x are vulnerable to authentication bypass. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the...
Apache Cocoon 2.1.12 - XML Injection
Apache Cocoon 2.1.12 is susceptible to XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system. id: CVE-2020-11991 info: name: Apache Cocoon 2.1.12 - XML...
Citrix StoreFront - Cross-Site Scripting
Reflected Cross-Site Scripting issue which is exploitable without authentication. This vulnerability was exploitable through coercing an error message during an XML parsing procedure in the SSO flow. id: CVE-2023-5914 info: name: Citrix StoreFront - Cross-Site Scripting author: DhiyaneshDK...
Sitecore CMS - Cross-Site Scripting
Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of displaying XML Controls directly, which allows for a Cross Site Scripting Attack. id: CVE-2014-100004 info: name: Sitecore CMS - Cross-Site Scripting author: DhiyaneshDK severity: medium description: | Sitecore CM...
Microweber <1.2.12 - Stored Cross-Site Scripting
Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. id: CVE-2022-0963 info: name: Microweber 1.2.12 - Stored Cross-Site Scripting author: amit-jd severity: medium description: | Microweber prior to 1.2.12 contains a stored...
apache-activemq-rce-research
Apache ActiveMQ Classic — RCE-исследование Личный исследовательский архив по цепочке удаленного выполнения кода RCE в Apache ActiveMQ Classic через Jolokia → addNetworkConnector → xbean/Spring-XML CVE-2026-34197 и обход патча CVE-2026-42588, а также полный аудит с автоисследованием исправленного...
Digital-Signature-Forgery-Attack
이 글에서는 디지털 서명 위조 공격Digital Signature Forgery Attack에 대해 살펴보겠습니다. 이러한 공격의 결과는 비트코인 네트워크에서 트랜잭션의 보안을 위협하는데, 그 이유는 디지털 서명이 암호화폐 전송의 소유권과 승인을 확인하기 때문입니다. 최신 연구와 확인된 취약점을 바탕으로 이러한 공격이 비트코인에 미치는 영향의 사례를 살펴보겠습니다. 디지털 서명 위조 공격Digital Signature Forgery Attack은 공격자가 비트코인 네트워크에서 유효한 것으로 인식될 가짜 ECDSA 디지털 서명을...
CVE-2024-34102
🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Мы требуем безопасного возвращения всех граждан, взятых в заложники террористической группировкой ХАМАС. Мы не успокоимся, пока каждый заложник не будет освобождён и не вернётся домой в безопасности. Вы можете помочь вернуть их...
CVE-2023-24055_PoC
CVE-2023-24055 PoC KeePass 2.5x В процессе обсуждения и анализа... https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/ https://sourceforge.net/p/keepass/feature-requests/2773/ Злоумышленник, имеющий доступ на запись к конфигурационному файлу KeePass, может изменить его и внедри...
cve-2017-12629
LISEZ-MOI Une exécution de code à distance se produit dans Apache Solr avant la version 7.1 avec Apache Lucene avant la version 7.1 en exploitant XXE en conjonction avec l'utilisation d'une commande add-listener de l'API Config pour atteindre la classe RunExecutableListener. Elasticsearch, bien...
geoserver-
geoserver CVE-2024-36401 Outil d'exploitation de vulnérabilité Environnement geoserver CVE-2024-36401 : JDK8 Déclaration : réservé aux tests autorisés. L'auteur n'est pas responsable des conséquences d'une mauvaise utilisation par les utilisateurs. Veuillez respecter les lois et règlements ! 1,...
CVE-2026-63077
Неаутентифицированное удалённое выполнение кода в JetBrains TeamCity CVE-2026-63077 Обзор Это proof-of-concept эксплойт для CVE-2026-63077. Организации могут использовать этот скрипт для проверки своих механизмов обнаружения и реагирования. Полный технический анализ CVE-2026-63077 читайте в нашем...
de4dot
Description de4dot is an open source GPLv3 .NET deobfuscator and unpacker written in C. It will try its best to restore a packed and obfuscated assembly to almost the original assembly. Most of the obfuscation can be completely restored eg. string encryption, but symbol renaming is impossible to...