CVE-2022-20729

A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...

Cisco Firepower Threat Defense Software XML Injection Vulnerability

A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...

Oracle WebLogic Server (Apr 2022 CPU)

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the April 2020 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities: - A temp directory creation vulnerability in the bundled Guava component that allows a low privileg...

XML Injection in Xerces Java affects Nokogiri

Summary Nokogiri v1.13.4 updates the vendored xerces:xercesImpl from 2.12.0 to 2.12.2, which addresses CVE-2022-23437. That CVE is scored as CVSS 6.5 "Medium" on the NVD record. Please note that this advisory only applies to the JRuby implementation of Nokogiri = v1.13.4. Impact CVE-2022-23437 in...

GHSA-XXX9-3XCR-GJJ3 XML Injection in Xerces Java affects Nokogiri

Summary Nokogiri v1.13.4 updates the vendored xerces:xercesImpl from 2.12.0 to 2.12.2, which addresses CVE-2022-23437. That CVE is scored as CVSS 6.5 "Medium" on the NVD record. Please note that this advisory only applies to the JRuby implementation of Nokogiri = v1.13.4. Impact CVE-2022-23437 in...

XML Injection in Xerces Java affects Nokogiri

Summary Nokogiri v1.13.4 updates the vendored xerces:xercesImpl from 2.12.0 to 2.12.2, which addresses CVE-2022-23437. That CVE is scored as CVSS 6.5 "Medium" on the NVD record. Please note that this advisory only applies to the JRuby implementation of Nokogiri = v1.13.4. Impact CVE-2022-23437 in...

CVE-2022-25356

Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection...

CVE-2022-25356

Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection...

Design/Logic Flaw

Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection...

CVE-2022-25356

Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection...

CVE-2022-25356

Summary of CVE-2022-25356 (Alt-n/MDaemon Security Gateway) : Affected product is Alt-n/MDaemon Security Gateway

CVE-2022-25356

Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection...

CVE-2022-25356: XML Injection (aka Blind XPath Injection)

Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection...

ALIN MDaemon Security Gateway 安全漏洞

MDaemon Technologies ALIN MDaemon Security Gateway is a security gateway for email servers from MDaemon Technologies, USA. A security vulnerability exists in ALIN MDaemon Security Gateway version 8.5.0 and prior versions that originates from allowing XML injection...

PT-2022-17235

Name of the Vulnerable Software and Affected Versions Alt-N MDaemon Security Gateway versions prior to 8.5.1 Description The issue allows for XML Injection through the SecurityGateway.dll, specifically when accessing the "view=login" API endpoint. Recommendations For versions prior to 8.5.1, upda...

Podcast Importer SecondLine < 1.3.8 - Admin+ SQLi

The plugin does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file PoC Put the XML below on a web server replacing the PAYLOAD with the correct one, then import a podcast...

Xxe

The wechatreturn function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml load String function, which itself does not prohibit external entities, triggering a XML external entity XXE injection vulnerability...

BuilderRevengeRAT XML Injection

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/531d8b4ac8f7eb827d62424169321b2b.txt Contact: [email protected] Media: twitter.com/malvuln Threat: BuilderRevengeRAT - Revenge-RAT v0.3 Vulnerability: XML External Entity Injection Description: The...

SAP NetWeaver AS JAVA XML External Entity Injection (CVE-2016-9563)

An XML external entity injection vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could result in the disclosure of file contents from the target system...

GHSA-5HR6-VC97-QXXH XML Injection in Crafter CMS Crafter Studio 3.0.1

Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity XXE. An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band...