cve-2017-9805.py

CVE-2017-9805.py 1. CVE 2017 9805 Apache Struts를 위한 더 나은 익스플로잇 코드 2. 대부분 오류가 없어야 합니다. 왜 다시 만들었나? 온라인에 있는 대부분의 익스플로잇 코드는 단순히 문자열 연결을 사용하여 사용자가 제공한 명령을 XML 문자열에 삽입한다는 것을 알았습니다. XML은 특수 문자에 인코딩이 필요하기 때문에 이 방식은 매우 신뢰할 수 없습니다. 따라서 이러한 스크립트가 이를 고려하지 않기 때문에 오류가 발생합니다. 또한 적절히 인코딩된 XML은 명령 실행에 문제를 일으킬 수...

JDSer-ngng

JDSer-ngng Java 객체를 역직렬화하고 Xtream 라이브러리를 사용하여 XML로 인코딩하는 Burp Extender 플러그인입니다. 왜? 이 릴리스는 실제로 요청 수정을 허용하지 않았던 JDSer-ng의 다른 구현에 있던 버그를 수정합니다. 또한 역직렬화된 Java 객체에 대해 Intruder/Scanner 모듈을 제대로 사용할 수 있도록 확장합니다. SQLMap과 함께 사용하는 기능도 추가했습니다. "send deserialized to intruder"의 출력을 파일에 복사하여 붙여넣고, sqlmap.py -r...

USN-8571-1 apache2 vulnerabilities

Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server incorrectly handled certain memory operations in modauthnsocache. A remote attacker could possibly use this issue to cause a denial of service. CVE-2026-33007 Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apach...

USN-8516-1 apache2 vulnerabilities

It was discovered that Apache HTTP Server's modldap module incorrectly handled memory when processing per-directory configurations. An attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2026-29167 It was discovered...

MiracleLinux 8 : libxml2-2.9.7-9.el8.2 (AXSA:2021-2193:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2193:02 advisory. libxml2: Use-after-free in xmlEncodeEntitiesInternal in entities.c CVE-2021-3516 libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal in...

SUSE SLED15: libQt5Bootstrap-devel-static / libQt5Bootstrap-devel-static-32bit / etc (SUSE-SU-2025:3723-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3723-1 advisory. Security issues fixed: - CVE-2025-5455: processing of malformed data in qDecodeDataUrl can trigg...

Security update for qt6-base

This update for qt6-base fixes the following issues: CVE-2025-5455: processing of malformed data in qDecodeDataUrl can trigger assertion and cause a crash bsc1243958. CVE-2025-30348: complex algorithm used in encodeText in QDom when processing XML data can cause low performance bsc1239896. Patch...

EUVD-2021-2551

Malware in sbrugna...

EUVD-2009-0901

Malware in sbrugna...

EUVD-2021-14641

Malware in sbrugna...

EUVD-2025-7261

Malicious code in bioql PyPI...

CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

CVE-2024-45293

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel XLS...

CVE-2024-45293 XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel XLS...

CVE-2024-45293 XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel XLS...

XXE in PHPSpreadsheet's XLSX reader

Summary The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel XLSX sheets, Server files and sensitive information can be disclosed by...

The vulnerability of the authentication library for exchanging identification data according to the SAML2 standard, related to improper verification of the cryptographic signature, allows a perpetrator to bypass the signature verification and gain access to protected information.

The vulnerability of the authentication library for exchanging identification data according to the SAML2 standard, implemented by PySAML2, is related to the XML signature encoding scheme used. This scheme does not verify whether the SAML document conforms to the XML schema. Exploiting this...

K49237345: BIG-IP Advanced WAF, ASM, and NGINX App Protect WAF XML encoding security exposure

Security Advisory Description F5 BIG-IP Advanced WAF, BIG-IP ASM, or NGINX App Protect WAF incorrectly handles certain requests. This issue occurs when the following condition is met: Advanced WAF, BIG-IP ASM, or NGINX App Protect WAF handles a malicious request with XML content type and XML...

SUSE CVE-2020-24977

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e...

SUSE CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...