XML Entity Injection Vulnerability in WebLogic SimpleDocument

Oracle WebLogic Server is a Java application server that fully implements the J2EE 1.5 specification, the latest Web services standards, and the highest level of interoperability standards. An XML entity injection vulnerability exists in WebLogic SimpleDocument, which can be exploited to send a...

XML Entity Injection Vulnerability in Mysql jdbc Driver

MySQL AB is a company founded by the founder and main developer of MySQL. An XML entity injection vulnerability exists in the Mysql jdbc driver, which can be exploited by attackers to gain server privileges...

YouDianCMS suffers from XML entity injection vulnerability (CNVD-2020-15540)

YouDianCMS is an enterprise website management system developed by Changsha YouDian Software Technology Co. YouDianCMS suffers from an XML entity injection vulnerability. An attacker can exploit the vulnerability to read arbitrary files, execute system commands, and probe intranet ports...

Security Bulletin: XML Entity Injection vulnerability affects IBM Sterling B2B Integrator (CVE-2017-1192)

Summary IBM Sterling File Gateway is vulnerable to an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2017-1192 DESCRIPTION: IB...

CVE-2019-3768

RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to cause information disclosure of local system files by supplying specially crafted XML message...

CVE-2019-3768

RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to cause information disclosure of local system files by supplying specially crafted XML message...

CVE-2019-3768

RSA Authentication Manager versions prior to 8.4 P7 are affected by an XML External Entity/Entity Injection vulnerability. A remote authenticated user could disclose local system files by sending specially crafted XML messages. The vulnerability is network-exploitable with low complexity and requ...

PYSEC-2019-105

The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML...

XML Entity Injection Vulnerability in zzzcms zzzphp Backend

zzzcms zzzphp is a content management system CMS. An XML entity injection vulnerability exists in the zzzcms zzzphp backend. An attacker can exploit the vulnerability to gain unauthorized access to files in arbitrary directories...

CVE-2019-8126

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external...

CVE-2019-8126

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external...

Design/Logic Flaw

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external...

XML Entity Injection Vulnerability in WebLogic

Oracle WebLogic is a Java EE application server. WebLogic suffers from an XML entity injection vulnerability that can be exploited by an attacker to obtain sensitive information...

XML Entity Injection Vulnerability in Kingdee Cloud K3 Cloud

Kingdee International Software Group Limited is a leading provider of enterprise management software and e-commerce application solutions in the Asia-Pacific region. An XML entity injection vulnerability exists in Kingdee Cloud K3 Cloud, which can be exploited by attackers to obtain sensitive...

XML Entity Injection Vulnerability in S-CMS Government Website Building System

S-CMS government station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions for station building products. S-CMS government website building system exists XML entity injection vulnerability, attackers can use the vulnerability to...

XML Entity Injection Vulnerability in PageOffice of Beijing Zhuozheng Zhiyuan Software Co.

PageOffice is a solution & product of Zhuozheng Software to solve office online office. PageOffice of Beijing Zhuozheng Zhiyuan Software Co., Ltd. exists XML entity injection vulnerability. The vulnerability arises from the program fails to adequately validate the XML document received from an...

xml entity injection vulnerability in ctcms version 2.0.2

Chongsheng Network Technology is an emerging network technology limited company. It has developed Cscms portal content management system, Ctcms network video education management system, polymerization payment, and a multi-merchant card issuance platform management system. ctcms2.0.2 version of t...

Oracle CTI Web Service - 'EBS_ASSET_HISTORY_OPERATIONS' XML Entity Injection

Exploit Title: Oracle CTI Web Service XML Entity Exp. Exploit Author: omurugur Author Web: https://www.justsecnow.com Author Social: @omurugurrr URL : http://server/EBSASSETHISTORYOPERATIONS As can be seen in the following request / response example, the xml entity expansion attack can be...

Oracle CTI Web Service - EBS_ASSET_HISTORY_OPERATIONS XML Entity Injection

Oracle CTI Web Service - EBSASSETHISTORYOPERATIONS XML Entity Injection Exploit Title: Oracle CTI Web Service XML Entity Exp. Exploit Author: omurugur Author Web: https://www.justsecnow.com Author Social: @omurugurrr URL : http://server/EBSASSETHISTORYOPERATIONS As can be seen in the following...

Security Bulletin: IBM i2 Analyst's Notebook XML Entity Injection Vulnerability

Summary IBM i2 Analyst's Notebook Premium version 9.0.8 has addresses the XML Entity Injection vulnerability detailed in CVE-2018-1527. When using any of the import features on IBM i2 Analyst's Notebook Premium, Cellebrite, XRY, and Notebook Exchange from the Import menu, it is possible to import...