Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the...

XXE Vulnerability in Ninth OA System

Ninth OA system is the OA system to install, implement, learn, operate and maintain. Ninth OA system DocumentBuilder db = ex.newDocumentBuilder; Document doc = db.parserequest.getInputStream; XXE vulnerability exists. An attacker can read arbitrary files on the server and obtain sensitive...

PT-2016-20: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "FloorPlanApp" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. How to...

PT-2016-22: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the GPL hidden content validation component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML...

PT-2016-24: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "TranslationSupport" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. H...

PT-2016-26: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "YWorksLayouter" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. How t...

PT-2016-25: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the GPL hidden content validation component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML...

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

It was found that the Java Standard Tag Library JSTL allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution...

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

It was found that the Java Standard Tag Library JSTL allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution...

CVE-2016-6898

XML external entity XXE vulnerability in the Hyper Management Module HMM in Huawei E9000 rack servers with software before V100R001C00SPC296 allows remote authenticated users to read arbitrary files or cause a denial of service web service outage via a crafted XML document...

CVE-2016-6898

XML external entity XXE vulnerability in the Hyper Management Module HMM in Huawei E9000 rack servers with software before V100R001C00SPC296 allows remote authenticated users to read arbitrary files or cause a denial of service web service outage via a crafted XML document...

Adobe ColdFusion 11 XML External Entity Injection

============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical ============================================= I. VULNERABILITY -------------------------...

Adobe ColdFusion 11 Update 10 - XML External Entity Injection

Adobe ColdFusion 11 Update 10 - XML External Entity Injection ''' ============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical...

Adobe ColdFusion < 11 Update 10 - XML External Entity Injection

Exploit for php platform in category web applications ''' ============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical...

Emerson Liebert SiteScan XML External Entity Vulnerability

OVERVIEW Researcher Evgeny Ermakov from Kaspersky Lab has identified an XML External Entity XXE vulnerability affecting Emerson’s Liebert SiteScan application. Emerson has produced patches to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The...

Xxe

The Office Open XML OOXML feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity...

CVE-2016-4264

The Office Open XML OOXML feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity...

CVE-2016-4264

CVE-2016-4264 affects Adobe ColdFusion 10 (before Update 21) and 11 (before Update 10). The OOXML feature parser is vulnerable to XML External Entity (XXE) processing via a crafted OOXML spreadsheet containing an external entity declaration and an entity reference, enabling reading of arbitrary f...

Adobe ColdFusion 'XML External Entity' Information Disclosure Vulnerability (APSB16-30)

Adobe ColdFusion is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Huawei E9000 Chassis XML External Entity Injection Vulnerability

The Huawei E9000 Chassis is a blade server from Huawei, a Chinese company. An XML external entity injection vulnerability exists in Huawei E9000 Chassis version V100R001C00. An attacker could exploit this vulnerability to obtain sensitive information and possibly cause a denial of service...