Hello! I'll give you additional information concerning SEC Consult Vulnerability Lab Security Advisory 20120626-0 (http://securityvulns.ru/docs28331.html). This advisory was about Local file disclosure via XXE injection in Zend Framework and was talking only about Local File Disclosure attack vector. It was just mentioned in description that via this vulnerability it's also possibility to open arbitrary TCP connections. LFD attack vector is important and is has more risk, so it's clear why Daniel concentrated on it. But I think that other attack vector is also important, so will bring your attention to it. As I've wrote in my July's article "Using XML External Entities (XXE) for attacks on other sites", which I've announced last week in WASC Mailing List (http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2012-August/008481.html), XXE vulnerabilities could be used for attacks on other sites. Similarly as AoF vulnerabilities, about which I've wrote in my 2010's article "Using of the sites for attacks on other sites" (http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html). In this article I've wrote about possibility of attacks on other sites via Abuse of Functionality and Remote File Include vulnerabilities, and showed examples of Abuse of Functionality holes at different web sites (including sites of Google, Yahoo and W3C). In similar way XXE vulnerabilities can be used for conducting CSRF and DoS attacks on other sites. XEE (WASC-43): For the attack it's needed to send the next XML data in POST request: ]> &xxe; It concerns as Zend Framework and different web applications, which are using Zend Framework (XXE holes in some of them were disclosed recently), as to those applications, holes in which were disclosed earlier. Like Adobe BlazeDS, Adobe LiveCycle Data Services ES2, Adobe ColdFusion, Adobe LiveCycle ES2 (http://securityvulns.ru/Xdocument288.html). So there are multiple web applications and thousands of web sites, which are vulnerable to these attacks (via Zend Framework and web applications based on it and via old versions of multiple Adobe's products). Not thousands of web applications (about AoF vulnerabilities in which I've wrote during 2010-2011) and millions of web sites, but still a lot, and in total we have a lot of web sites, which can be used for attacks on other sites via different vulnerabilities (AoF, RFI, XXE). So web developers also should draw attention to this attack vector. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua