CVE-2015-2556

The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity...

CVE-2015-2556

CVE-2015-2556 is an information-disclosure vulnerability affecting Microsoft SharePoint Server 2007 SP3 and 2010 SP2, arising from how the InfoPath Forms Services component parses DTDs. The root cause is improper handling of XML External Entities (XXE), allowing a remote attacker to read arbitrar...

CVE-2015-2556: Exposure of Sensitive Information to an Unauthorized Actor

The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity...

PicketLink: XXE via insecure DocumentBuilderFactory usage

It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the...

用友软件企业门户xxe漏洞[测试前用友官域]

简要描述： 用友自带技能。 详细说明： 漏洞描述： 测试的时候发现使用yongyou nc的目录下有uapws/目录。百度百科。 打开后。自带登录模式，密码直接给你准备好了，登录就行了。好有爱。 找个接口，先提交请求。然后进行format the response（在这里抓包） xxe漏洞 漏洞证明： 高清无码 https://images.seebug.org/upload/201509/301834010d7b0d90e830d78290493a8fee...

CVE-2015-6463

CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via a longtag XML schema containing an external entity declaration in...

CVE-2015-6463

CVE-2015-6463 concerns CodeWrights HART Comm DTM components used with Endress+Hauser FieldCare. The vulnerability arises from processing a longtag XML schema containing an external entity declaration and an entity reference (XXE), enabling a remote attacker to read arbitrary files, issue HTTP req...

Square Victoria O2O business system SQL injection vulnerability+XXE entity injection demo validation-vulnerability warning-the black bar safety net

Square Victoria O2O, the demo site address: http://o2odemo.fanwe.net/ /cpapi/qxtapi.php code area define"FILEPATH","/cpapi"; requireonce '../system/systeminit.php'; $ip = CLIENTIP; $xml = filegetcontents'php://input'; if$ip!=' 221.179.180.156' || $xml=="" header"Content-Type:text/html;...

PT-2015-7257

Name of the Vulnerable Software and Affected Versions CodeWrights HART Comm DTM components affected versions not specified Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via a...

CVE-2015-6463: Undefined Security Weakness

CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via a longtag XML schema containing an external entity declaration in...

F5 Networks BIG-IP : SOAP parser vulnerability (SOL15879)

The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue in the soapxmlParseFile and...

CVE-2015-3623

The CVE-2015-3623 entry documents an XXE vulnerability in QlikTech QlikView prior to version 11.20 SR12. The flaw occurs in the AccessPoint.aspx XML parser, allowing an unauthenticated remote attacker to perform server-side request forgery (SSRF) and read arbitrary files via specially crafted XML...

CVE-2015-3623

XML external entity XXE vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery SSRF attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx...

PT-2015-6244

Name of the Vulnerable Software and Affected Versions QlikTech Qlikview versions prior to 11.20 SR12 Description The issue allows remote attackers to conduct server-side request forgery SSRF attacks and read arbitrary files via crafted XML data in a request to "AccessPoint.aspx". This is due to a...

CVE-2015-3623: Undefined Security Weakness

XML external entity XXE vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery SSRF attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx...

WukongCRM 0.5.1 /App/Lib/Action/WeixinAction.class.php XXE漏洞

No description provided by source...

SAP Mobile Platform XXE injection

Few XXE injections...

SAP Mobile Platform 3 XXE Injection

ERPSCAN Research Advisory ERPSCAN-15-014 SAP Mobile Platform 3 – XXE in Add Repository Application: SAP Mobile Platform Versions Affected: SAP Mobile Platform 3, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Sent: 13.03.2015 Reported: 14.03.2015 Vendor response: 14.03.2015...

Qlikview 11.20 SR11 - Blind XML External Entity Injection

Exploit Title: Qlikview blind XXE security vulnerability Product: Qlikview Vulnerable Versions: v11.20 SR11 and previous versions Tested Version: v11.20 SR4 Advisory Publication: 08/09/2015 Latest Update: 08/09/2015 Vulnerability Type: Improper Restriction of XML External Entity Reference CWE-611...

Qlikview 11.20 SR4 Blind XXE Injection

Exploit Title: Qlikview blind XXE security vulnerability Product: Qlikview Vulnerable Versions: v11.20 SR11 and previous versions Tested Version: v11.20 SR4 Advisory Publication: 08/09/2015 Latest Update: 08/09/2015 Vulnerability Type: Improper Restriction of XML External Entity Reference CWE-611...