9979 matches found
Xxe
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml...
CVE-2019-12331
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml...
Citrix StoreFront Server XML External Entity Injection (CVE-2019-13608)
An XML external entity injection vulnerability exists in Citrix StoreFront Server. A successful exploitation of this vulnerability could result in the disclosure of file contents from the target system...
PT-2019-12758 · Phpoffice · Phpoffice Phpspreadsheet
Name of the Vulnerable Software and Affected Versions: PHPOffice PhpSpreadsheet versions prior to 1.8.0 Description: The issue arises from the XmlScanner decoding sheet1.xml from an .xlsx file to utf-8 if a different encoding is declared in the header. This was initially intended as a security...
Advantech WISE-PaaS/RMM RecoveryMgmt ActionCommd_ota XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RecoveryMgmt class. Due to the improper restriction of XML External...
Advantech WISE-PaaS/RMM XML External Entity Injection Vulnerability
Advantech WISE-PaaS/RMM is an IoT device remote monitoring and management platform. An XML External Entity Injection XXE vulnerability exists in Advantech WISE-PaaS/RMM 3.3.29 and earlier versions. An attacker can exploit this vulnerability to obtain sensitive data...
Advantech WISE-PaaS/RMM AccountMgmt activateAccount XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AccountMgmt class. Due to the improper restriction of XML External...
Advantech WISE-PaaS/RMM AccountMgmt forgotPwd XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AccountMgmt class. Due to the improper restriction of XML External...
Advantech WISE-PaaS/RMM RecoveryMgmt groupFuzzSearch XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RecoveryMgmt class. Due to the improper restriction of XML External...
CVE-2019-18227
Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data...
Citrix StoreFront Server 7.15 - XML External Entity Injection
Citrix StoreFront Server 7.15 - XML External Entity Injection Exploit Title: Citrix StoreFront Server 7.15 - XML External Entity Injection Date: 2019-08-28 Exploit Author: Vahagn Vardanya Vendor Homepage:https://www.citrix.com/downloads/storefront/ Software Link:...
Citrix StoreFront Server 7.15 - XML External Entity Injection Vulnerability
Exploit for xml platform in category web applications Exploit Title: Citrix StoreFront Server 7.15 - XML External Entity Injection Exploit Author: Vahagn Vardanya Vendor Homepage:https://www.citrix.com/downloads/storefront/ Software Link: https://support.citrix.com/article/CTX251988 Version: Citr...
LabKey Server XML External Entity Injection Vulnerability
LabKey Server is a biomedical research data repository from LabKey, Inc. The repository allows Web-based querying, reporting, and collaboration across a wide range of data sources. An XML external entity injection vulnerability exists in LabKey Server. An attacker could exploit this vulnerability...
Citrix StoreFront Server 7.15 - XML External Entity Injection
Exploit Title: Citrix StoreFront Server 7.15 - XML External Entity Injection Date: 2019-08-28 Exploit Author: Vahagn Vardanya Vendor Homepage:https://www.citrix.com/downloads/storefront/ Software Link: https://support.citrix.com/article/CTX251988 Version: Citrix StoreFront Server earlier than 190...
CVE-2019-9757
An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read...
Xxe
An XML External Entity Injection vulnerability exists in Dzone AnswerHub...
CVE-2017-15725
An XML External Entity Injection vulnerability exists in Dzone AnswerHub...
CVE-2017-15725
CVE-2017-15725: An XML External Entity (XXE) vulnerability in Dzone AnswerHub. NVD metrics show CVSSv2 base 5.0 (Partial confidentiality) and CVSSv3.1 base 7.5 (High) with network attack vector and no user interaction. No exploitation details or fixes are provided in the documents.
