CVE-2022-31259

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

EUVD-2015-0767

Malware in sbrugna...

EUVD-2022-4661

Malicious code in bioql PyPI...

Security Bulletin: Denial of service may affect IBM HTTP Server (CVE-2015-1283)

Summary Denial of service may affect IBM HTTP Server. The IBM HTTP Server is used by IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2015-1283 DESCRIPTION: Multiple integer overflows in the XMLGetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403....

Microsoft Visual Basic 2010 Express XML Injection

Exploit Title: Microsoft Visual Basic 2010 Express - XML External Entity Injection Exploit Author: ZwX Exploit Date: 2019-12-03 Version Software : 10.0.30319.1 RTMRel Vendor Homepage : https://www.microsoft.com/ Software Link:...

CVE-2019-0345

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

Automated API Protection with WAP

For those who use Web Application Protector from Akamai: "Your APIs just got an extra layer of protection". For everyone else, learn how easy a WAF can be. You protect your web applications, that's awesome, but what about all your APIs? Do you know how many you have, who accesses them and what...

Exploiting CVE-2016-4264 With OXML_XXE

Recently ColdFusion was shown vulnerable to XXE based attacks in OXML documents; CVE-2016-4264. The blog post linked gives an example building the file using python; cool! Its easy to backdoor files in a similar fashion with OXML XXE. The fastest way to do this is using the "Overwrite File inside...

Darwin Streaming Server <= 4.1.2 (parse_xml.cgi) Code Execution Exploit

No description provided by source. !/usr/bin/perl QTTS REMOTE ROOT exploit by FOXMULDER [email protected] FOXMULDER PRESENTS foxmulderatabv.bg DarwinOSX4.x? 5.X QTSSQuick Time Stream Server 3.X The bug in Darwin 5.X with unpatched QTSS in parsexml.cgi which lead to remote root compromise: $filenam...