1505 matches found
CVE-2021-27777: XML Injection (aka Blind XPath Injection)
XML External Entity XXE injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references...
SAP BusinessObjects Intelligence 4.3 XML Injection
Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity XXE Google Dork: N/A Date: 4/21/2022 Exploit Author: West Shepherd Vendor Homepage: https://www.sap.com/ Software Link: https://www.sap.com/ Version: 4.2 and 4.3 Tested on: Windows Server 2019 x64 CVE : CVE-2022-28213...
CVE-2022-24039
A vulnerability has been identified in Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such...
CVE-2022-24039
The CVE-2022-24039 vulnerability affects Siemens Desigo PXC4 (pre-2.20.142.10-10884) and Desigo PXC5 (pre-2.20.142.10-10884). The addCell JavaScript function does not properly sanitize user-controlled input when building the XML for XLS reports, allowing injection of arbitrary content (e.g., XML ...
CVE-2022-24039
A vulnerability has been identified in Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such...
PT-2022-2567 · Siemens · Desigo Pxc4 +1
Name of the Vulnerable Software and Affected Versions: Desigo PXC4 versions prior to V02.20.142.10-10884 Desigo PXC5 versions prior to V02.20.142.10-10884 Description: A vulnerability has been identified in the addCell JavaScript function, which fails to properly sanitize user-controllable input...
Cisco Firepower Threat Defense Software XML Injection (cisco-sa-ftd-xmlinj-8GWjGzKe)
According to its self-reported version, Cisco FTD Software is affected by an XML injection vulnerability. An authenticated, local attacker can inject XML into the command parser, which could result in the unexpected processing of the command and unexpected output. Please see the included Cisco BI...
CVE-2022-20729
A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...
Input validation
A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...
CVE-2022-20729 Cisco Firepower Threat Defense Software XML Injection Vulnerability
A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...
CVE-2022-20729 Cisco Firepower Threat Defense Software XML Injection Vulnerability
A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...
CVE-2022-20729: XML Injection (aka Blind XPath Injection)
A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...
Cisco Firepower Threat Defense Software XML Injection Vulnerability
A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...
CVE-2022-20729
A vulnerability in CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands...
Oracle WebLogic Server (Apr 2022 CPU)
The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the April 2020 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities: - A temp directory creation vulnerability in the bundled Guava component that allows a low privileg...
XML Injection in Xerces Java affects Nokogiri
Summary Nokogiri v1.13.4 updates the vendored xerces:xercesImpl from 2.12.0 to 2.12.2, which addresses CVE-2022-23437. That CVE is scored as CVSS 6.5 "Medium" on the NVD record. Please note that this advisory only applies to the JRuby implementation of Nokogiri = v1.13.4. Impact CVE-2022-23437 in...
GHSA-XXX9-3XCR-GJJ3 XML Injection in Xerces Java affects Nokogiri
Summary Nokogiri v1.13.4 updates the vendored xerces:xercesImpl from 2.12.0 to 2.12.2, which addresses CVE-2022-23437. That CVE is scored as CVSS 6.5 "Medium" on the NVD record. Please note that this advisory only applies to the JRuby implementation of Nokogiri = v1.13.4. Impact CVE-2022-23437 in...
XML Injection in Xerces Java affects Nokogiri
Summary Nokogiri v1.13.4 updates the vendored xerces:xercesImpl from 2.12.0 to 2.12.2, which addresses CVE-2022-23437. That CVE is scored as CVSS 6.5 "Medium" on the NVD record. Please note that this advisory only applies to the JRuby implementation of Nokogiri = v1.13.4. Impact CVE-2022-23437 in...
