WinRAR 5.80 XML Injection

Exploit Title: winrar External Entity Injection Exploit Author: albalawi-s Vendor Homepage: https://win-rar.com Software Link: https://win-rar.com/fileadmin/winrar-versions/winrar-x64-58b2.exe Version: 5.80 Tested on: Microsoft Windows Version 10.0.18362.418 64bit https://twitter.com/testapp poc...

CVE-2019-17626: XML Injection (aka Blind XPath Injection)

ReportLab through 3.5.26 allows remote code execution because of toColorevalarg in colors.py, as demonstrated by a crafted XML document with '...

CVE-2019-4539

IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. IBM X-Force ID: 165812...

CVE-2019-4539

IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. IBM X-Force ID: 165812...

CVE-2019-4539

CVE-2019-4539 affects IBM Security Directory Server 6.4.0. The vulnerability stems from improper neutralization of XML elements, allowing an attacker to modify XML syntax/content/commands before processing. IBM’s bulletin for this product/version documents the issue and provides a remediation: up...

CVE-2019-4539: XML Injection (aka Blind XPath Injection)

IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. IBM X-Force ID: 165812...

Exploit for XML Injection (aka Blind XPath Injection) in Nsa Ghidra

CVE-2019-16941 Proof-of-Concept: The vulnerability requires...

CVE-2019-16941: XML Injection (aka Blind XPath Injection)

NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An...

EulerOS 2.0 SP5 : dom4j (EulerOS-SA-2019-1960)

According to the version of the dom4j package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can...

LimeSurvey < 3.17.14 Multiple Vulnerabilities

LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Limesurvey XML Injection Vulnerability

limesurvey is an open source online questionnaire program with many functions such as questionnaire design, modification, release, recovery and statistics. An XML injection vulnerability exists in Limesurvey versions prior to 3.17.14. A remote attacker can exploit this vulnerability to import a...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

Design/Logic Flaw

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

CVE-2019-16174

Summary: CVE-2019-16174 is an XML injection vulnerability in LimeSurvey prior to version 3.17.14. The issue allows remote attackers to import specially crafted XML files and either execute code or compromise data integrity. Affected software: LimeSurvey core prior to 3.17.14. Root cause / vector:...

PT-2019-14554

Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14 Description An XML injection issue allows remote attackers to import specially crafted XML files, potentially executing code or compromising data integrity. Recommendations For versions prior to 3.17.14,...

CVE-2019-16174: Improper Restriction of XML External Entity Reference

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

Tableau XML Injection

Exploit Title: Tableau XXE Google Dork: N/A Date: Reported to vendor July 2019, fix released August 2019. Exploit Author: Jarad Kopf Vendor Homepage: https://www.tableau.com/ Software Link: Tableau Desktop downloads: https://www.tableau.com/products/desktop/download Version/Products: See Tableau...