Zend Framework 'Zend_Feed'组件信息泄露漏洞

BUGTRAQ ID: 56982 Zend Framework ZF 是一个开放源代码的 PHP5 开发框架，可用于来开发 web 程序和服务。 Zend Framework 1.11.15、1.12.1之前版本的ZendFeedRss、ZendFeedAtom类由于使用了不安全的PHP DOM扩展，其"ZendFeed"组件在处理xml数据时存在漏洞，通过发送包含有外部实体引用的特制XML数据，攻击者可利用此漏洞打开任意文件，最终导致了本地文件信息泄露漏洞。 0 Zend Zend Framework 1.11.6 Zend Zend Framework 1.11.4 Zend Ze...

Mandriva Update for postgresql MDVSA-2012:139 (postgresql)

Check for the Version of postgresql OpenVAS Vulnerability Test Mandriva Update for postgresql MDVSA-2012:139 postgresql Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modif...

Zend Framework -- Multiple vulnerabilities via XXE injection

The Zend Framework team reports: The XmlRpc package of Zend Framework is vulnerable to XML eXternal Entity Injection attacks both server and client. The SimpleXMLElement class SimpleXML PHP extension is used in an insecure way to parse XML data. External entities can be specified by adding a...

CVE-2012-2921

Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document...

Design/Logic Flaw

Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document...

PYSEC-2012-14

Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document...

PYSEC-2012-14

Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document...

CVE-2012-2921

Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document...

CVE-2012-2921

Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document...

CVE-2012-2921: Undefined Security Weakness

Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document...

Fedora 16 : raptor2-2.0.7-1.fc16 (2012-4663)

new raptor2-2.0.7 release highlights : - CVE-2012-0037 fixed - Removed Expat support - Removed internal Unicode NFC code for better and optional ICU - Added options for denying file requests and XML entity loading - Added options for SSL certificate verifying - Fixed reported issues: 0000448 and...

Fedora 17 : raptor2-2.0.7-1.fc17 (2012-4629)

new raptor2-2.0.7 release highlights : - CVE-2012-0037 fixed - Removed Expat support - Removed internal Unicode NFC code for better and optional ICU - Added options for denying file requests and XML entity loading - Added options for SSL certificate verifying - Fixed reported issues: 0000448 and...

raptor security update

1.4.18-5.1 - Fixed XML entity expansion that could lead to information disclosure CVE-2012-0037 Resolves: rhbz804496...

DSA-2424-1 libxml-atom-perl - XML entity expansion

Bulletin has no description...

phpMyAdmin 3.3.X and 3.4.X - Local File Inclusion via XXE Injection

No description provided by source. Exploit Title: poc-phpmyadmin-local-file-inclusion-via-xxe-injection Date: 12-01-2012 Author: Marco Batista Blog Link: http://www.secforce.com/blog/2012/01/cve-2011-4107-poc-phpmyadmin-local-file-inclusion-via-xxe-injection/ Tested on: Windows and Linux -...

phpMyAdmin 3.3.x / 3.4.x Local File Inclusion Via XXE Injection

Exploit Title: poc-phpmyadmin-local-file-inclusion-via-xxe-injection Date: 12-01-2012 Author: Marco Batista Blog Link: http://www.secforce.com/blog/2012/01/cve-2011-4107-poc-phpmyadmin-local-file-inclusion-via-xxe-injection/ Tested on: Windows and Linux - phpmyadmin versions: 3.3.6, 3.3.10, 3.4.0...

phpMyAdmin 3.3.x3.4.x - Local File Inclusion via XML External Entity Injection (Metasploit)

phpMyAdmin 3.3.x3.4.x - Local File Inclusion via XML External Entity Injection Metasploit Exploit Title: poc-phpmyadmin-local-file-inclusion-via-xxe-injection Date: 12-01-2012 Author: Marco Batista Blog Link:...

Mandriva Update for phpmyadmin MDVSA-2011:198 (phpmyadmin)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Multiple vulnerabilities in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Local file inclusion. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.11.8 and below Vulnerability Type: Local file inclusion...

Local file inclusion.

PMASA-2011-17 Announcement-ID: PMASA-2011-17 Date: 2011-11-10 Summary Local file inclusion. Description Importing a specially-crafted XML file which contains an XML entity injection permits to retrieve a local file limited by the privileges of the user running the web server. Severity We consider...