XML External Entity (XXE)

bw-webdav is vulnerable to XML external entities attacks XXE. The parseContent function in webdav/servlet/common/MethodBase.java and the processXML function in webdav/servlet/common/PostRequestPars.java do not implement secure XML parsing which would allow a remote attacker to perform XXE attacks...

CVE-2018-20000

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java...

CVE-2018-20000

Apereo Bedework bw-webdav contains an XML External Entity (XXE) vulnerability (CVE-2018-20000) in versions before 4.0.3. The issue arises in the XML parsing code paths used by a webdav servlet (notably MethodBase.java and PostRequestPars.java), allowing an attacker to read local files via special...

CVE-2018-20000

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java...

bw-ladungssicherung.de XSS vulnerability

Open Bug Bounty ID: OBB-643789 Description| Value ---|--- Affected Website:| bw-ladungssicherung.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bw-running.de XSS vulnerability

Open Bug Bounty ID: OBB-440362 Description| Value ---|--- Affected Website:| bw-running.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DEBIAN-CVE-2014-8127

LibTIFF 4.0.3 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted TIFF image to the 1 checkInkNamesString function in tifdir.c in the thumbnail tool, 2 compresscontig function in tiff2bw.c in the tiff2bw tool, 3 putcontig8bitCIELab function in...

bigband-bw.de XSS vulnerability

Vulnerable URL: http://www.bigband-bw.de/index.php?gotarget=suchergebnis=%22%3E%3CsvG%2Fonload%3Dalert%2FOPENBUGBOUNTY%2F%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6159848...

bw-krefeld.de XSS vulnerability

Open Bug Bounty ID: OBB-205263 Description| Value ---|--- Affected Website:| bw-krefeld.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

EVA-BW - Verkehrsauskunft - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application EVA-BW - Verkehrsauskunft published at the 'play' market has multiple vulnerabilities...

BW Mobilbanking - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application BW Mobilbanking published at the 'play' market has multiple vulnerabilities...

Unspecified vulnerability in Harman AMX (CNVD-2016-00786)

Harman AMX is a series of conversion controller products from Harman USA. A security vulnerability exists in the 'setUpSubtleUserAccount' function in the /bin/bw URI in versions of Harman AMX prior to 2015-10-12, which stems from the use of hard-coded passwords for BlackWidow accounts. A remote...

CVE-2015-8362

CVE-2015-8362 affects Harman AMX devices (various NetLinx controllers, Massio MCP-10x, Enova DGX/DVX lines, NI/NX series, ME260/64, etc.) where the setUpSubtleUserAccount function in /bin/bw uses a hard-coded BlackWidow diagnostic account password. This creates remote-access risk via SSH or HTTP ...

bw-cct.de XSS vulnerability

Vulnerable URL: http://www.bw-cct.de/sucherg.php Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 12:27 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1281720 Google Pagerank| 5 VIP website status:| No Check...

Design/Logic Flaw

Business Warehouse BW in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDUCCMSGETPROFILEPARAM RFC function...

SAP NetWeaver BW - XML External Entity

Application: SAP BW Versions Affected: SAP BASIS 6.40/7.02 maybe others Vendor URL: http://www.sap.com Bugs:XML External Entity Exploits: YES Reported: 13.05.2011 Vendor response: 14.05.2011 Date of Public Advisory: 30.06.2012 Reference: SAP Security Note 1597066 Author: Alexey Tyurin ERPScan...