what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 255 RSS Feed

XML Injection Files

Dell EMC ECOM XML External Entity Injection
Posted Apr 26, 2018
Authored by Jakub Palaczynski | Site emc.com

The Dell EMC Common Object Manager (ECOM) component used in multiple Dell EMC products is affected by a XML External Entity (XXE) Injection vulnerability that may potentially be exploited by malicious users to compromise the affected system.

tags | advisory, xxe
SHA-256 | ca38cccc3045ff5a40c220fdf2a44b66a7339f491e382df921a3922abcedc6dd
Debian Security Advisory 4175-1
Posted Apr 22, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4175-1 - Wojciech Regula discovered an XML External Entity vulnerability in the XML Parser of the mindmap loader in freeplane, a Java program for working with mind maps, resulting in potential information disclosure if a malicious mind map file is opened.

tags | advisory, java, info disclosure, xxe
systems | linux, debian
advisories | CVE-2018-1000069
SHA-256 | c456759cde28b933ea6dc80d25171392f1e7c16e867cd1b223b5cfa8a4a89c38
Digital Guardian Management Console 7.1.2.0015 XXE Injection
Posted Apr 19, 2018
Authored by Pawel Gocyla

Digital Guardian Management Console version 7.1.2.0015 suffers from an XML external entity injection vulnerability.

tags | exploit, xxe
advisories | CVE-2018-10175
SHA-256 | 7cec0fd3e8efd19ae243d045d84667f65746f0c3315377e8314d97b5817a1fc7
Geist WatchDog Console 3.2.2 XSS / XML Injection / Insecure Permissions
Posted Apr 19, 2018
Authored by bzyo

Geist WatchDog Console version 3.2.2 suffers from cross site scripting, XML external entity injection, and insecure file permission vulnerabilities.

tags | exploit, vulnerability, xss, xxe
advisories | CVE-2018-10077, CVE-2018-10078, CVE-2018-10079
SHA-256 | d918f241ee6c7025f29ccf1f1cb519560eb23c715777ff59995bc0cdf7a81280
KYOCERA Multi-Set Template Editor 3.4 Out-Of-Band XML External Entity Injection
Posted Apr 9, 2018
Authored by LiquidWorm | Site zeroscience.mk

KYOCERA Multi-Set Template Editor version 3.4.0906 suffers from an out-of-band XML external entity injection vulnerability.

tags | exploit, xxe
SHA-256 | c9052cd2ab7f9839495ce8d05c2a907fa7501d1dceff407eac665610153825a5
Microsoft Windows Remote Assistance XXE Injection
Posted Mar 28, 2018
Authored by Nabeel Ahmed

Microsoft Windows Remote Assistance suffers from an XML external entity injection vulnerability.

tags | exploit, remote, xxe
systems | windows
advisories | CVE-2018-0878
SHA-256 | 30f3cbd80b79f0e54f6c7a336934dced0eac0a94cb3f89c1fa94def8ecf8a977
Micro Focus Security Bulletin MFSBGN03797 1
Posted Feb 2, 2018
Authored by Micro Focus | Site microfocus.com

Micro Focus Security Bulletin MFSBGN03797 1 - A potential security vulnerability has been identified in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC). The vulnerability could be exploited to allow XML External Entity (XXE) injection. Revision 1 of this advisory.

tags | advisory, xxe
advisories | CVE-2018-6486
SHA-256 | 51226d70f2a4c9992bea2c5c5282c64bfc317194d1ea20fdf55efb2aefb2364c
Oracle Financial Services Analytical Applications 7.3.5.x / 8.0.x XXE Injection / XSS
Posted Jan 24, 2018
Authored by Samandeep Singh, Mohammad Shah Bin Mohammad Esa | Site sec-consult.com

Oracle Financial Services Analytical Applications versions 7.3.5.x and 8.0.x suffer from XML external entity injection and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss, xxe
advisories | CVE-2018-2660, CVE-2018-2661
SHA-256 | 596ba7a1bde4935da9df89c58e1d05d2e8ba24cba2ef3cb2156029511e53d6b4
Red Hat Security Advisory 2017-3452-01
Posted Dec 13, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-3452-01 - Apache Lucene is a high-performance, full-featured text search engine library written entirely in Java. It is a technology suitable for nearly any application that requires full-text search, especially cross-platform. Security Fix: It was discovered that Lucene's XML query parser did not properly restrict doctype declaration and expansion of external entities. An attacker with access to an application using a Lucene XML query parser could exploit this flaw to perform XML eXternal Entity attacks.

tags | advisory, java, xxe
systems | linux, redhat
advisories | CVE-2017-12629
SHA-256 | 26e4726f6f0f7896cd9ba554784035113622f24b3a03626fd4b1e47b30def97e
Red Hat Security Advisory 2017-3451-01
Posted Dec 13, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-3451-01 - Apache Lucene is a high-performance, full-featured text search engine library written entirely in Java. It is a technology suitable for nearly any application that requires full-text search, especially cross-platform. Security Fix: It was discovered that Lucene's XML query parser did not properly restrict doctype declaration and expansion of external entities. An attacker with access to an application using a Lucene XML query parser could exploit this flaw to perform XML eXternal Entity attacks.

tags | advisory, java, xxe
systems | linux, redhat
advisories | CVE-2017-12629
SHA-256 | 121c43b8294f271b4d791d9a53c87376dd04c9aa6efe6e6e2b4d2274c61a3262
Diving Log 6.0 XML External Entity Injection
Posted Nov 27, 2017
Authored by Trent Gordon

Diving Log version 6.0 suffers from an XML external entity injection vulnerability.

tags | exploit, xxe
advisories | CVE-2017-9095
SHA-256 | d0450eb5a8f82ef2929848b75adb39ccab2685f6239626955cde5507f931229d
iText PDF Library 7.0.2 / 5.5.11 / 2.0.8 XXE Injection
Posted Nov 6, 2017
Authored by Benjamin Bruppacher

iText PDF Library versions 2.0.8, 5.5.11, and 7.0.2 suffer from an XML external entity injection vulnerability. The attack can be carried out by submitting a malicious PDF to an iText application that parses XML data. By providing a malicious XXE payloads inside the XML data that resides in the PDF, an attacker can for example extract files or forge requests on the server.

tags | advisory, xxe
advisories | CVE-2017-9096
SHA-256 | 28a8b1badebadad07e326e2363388a39384fcbcb1f223722393aafea4bef3345
Ladon Framework For Python 0.9.40 XXE Injection
Posted Nov 3, 2017
Site redteam-pentesting.de

Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service with exponentially growing memory payloads. Versions 0.9.40 and below are affected.

tags | exploit, web, local, xxe
SHA-256 | ed8acdbe74a60413ec64bf7ee626907c637009037aa099593ef2ffdb4b694c81
Oracle Java SE Wv8u131 Information Disclosure
Posted Nov 2, 2017
Authored by mr_me

Oracle Java SE installs a protocol handler in the registry as "HKEY_CLASSES_ROOT\jnlp\Shell\Open\Command\Default" 'C:\Program Files\Java\jre1.8.0_131\bin\jp2launcher.exe" -securejws "%1"'. This can allow allow an attacker to launch remote jnlp files with little user interaction. A malicious jnlp file containing a crafted XML XXE attack can be leveraged to disclose files, cause a denial of service or trigger SSRF. Versions v8u131 and below are affected.

tags | exploit, java, remote, denial of service, shell, registry, protocol, info disclosure, xxe
advisories | CVE-2017-10309
SHA-256 | 95eeae9eabde4f8ff4be6539a758b833f6a5e74bc86b983863634a6eabcb0b56
Mura CMS Server-Side Request Forgery / XXE Injection
Posted Oct 26, 2017
Authored by Anthony Cole

Mura CMS versions prior to 6.2 suffer from server-side request forgery and XML external entity injection vulnerabilities.

tags | exploit, vulnerability, xxe
advisories | CVE-2017-15639
SHA-256 | c741fa594f6ecdac9c58e2a524f6ef11f7b20005c381775459dc8b4332c6578d
Microsoft Windows GDFMaker 6.3.9600.16384 XXE Injection
Posted Oct 18, 2017
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Microsoft Windows Game Definition File Editor (GDFMaker) version 6.3.9600.16384 suffers from an XML external entity injection vulnerability.

tags | exploit, xxe
systems | windows
SHA-256 | 10f87d3d1b9071caa4665070b4aa0e2d5a5dea176d6602bf53f8a85c7ceff9c0
Apache Solr 7.0.1 XXE Injection / Code Execution
Posted Oct 18, 2017
Authored by Michael Stepankin, Olga Barinova

Apache Solar version 7.0.1 suffers from XML external entity injection and remote code execution vulnerabilities.

tags | exploit, remote, vulnerability, code execution, xxe
advisories | CVE-2017-12629
SHA-256 | 329a2e9c8a0283ae00e021c2cda2241153ca88f96329701ff8bb3b1e24590293
Lansweeper 6.0.100.29 XXE Injection
Posted Oct 6, 2017
Authored by Mehmet Ince, Barkin Kilic

Lansweeper version 6.0.100.29 suffers from an XML external entity injection vulnerability.

tags | exploit, xxe
advisories | CVE-2017-13706
SHA-256 | ca71842cb4e74173030f211999d389dfe2a9a3c19eef8bf22a35b124a45d5cc4
OpenText Document Sciences xPression 4.5SP1 Patch 13 XML Injection
Posted Sep 29, 2017
Authored by Mariusz Woloszyn

OpenText Document Sciences xPression version 4.5SP1 Patch 13 suffers from an XML external entity injection vulnerability.

tags | exploit, xxe
advisories | CVE-2017-14759
SHA-256 | cb063feea8c14d949fd64fa4cffed3d0e978d0cfdea136ab6e161807cb366f78
OpenText Documentum Administrator / Webtop XXE Injection
Posted Sep 27, 2017
Authored by Jakub Palaczynski, Pawel Gocyla

OpenText Documentum Administrator version 7.2.0180.0055 and Documentum Webtop version 6.8.0160.0073 suffer from XML external entity injection vulnerabilities.

tags | exploit, vulnerability, xxe
advisories | CVE-2017-14526, CVE-2017-14527
SHA-256 | 9447f70c1cfba534cf62cd68923f8cb3c42fb6f8ccf56f0f659927fcf0c4317e
IBM Infosphere Information Server / Datastage 11.5 Command Execution / Bypass
Posted Sep 15, 2017
Authored by Samandeep Singh, Goh Zhi Hao, Mohammad Shah Bin Mohammad Esa | Site sec-consult.com

IBM Infosphere Information Server / Datastage versions 9.1, 11.3, and 11.5 (including Cloud version 11.5) suffer from bypass, XML external entity injection, DLL side loading, and various other vulnerabilities.

tags | exploit, vulnerability, xxe
advisories | CVE-2017-1383, CVE-2017-1467, CVE-2017-1468, CVE-2017-1495
SHA-256 | ea53053471a3eeb44443432b6095afa188583cf9617704a2e1f792491a59b12a
OSCI-Transport Library 1.2 Padding Oracle / Signature Wrapping / XXE Injection
Posted Jun 30, 2017
Authored by Wolfgang Ettlinger, Marc Nimmerrichter | Site sec-consult.com

OSCI-Transport library version 1.2 for German e-Government suffers from padding oracle, signature wrapping, and XML external entity injection vulnerabilities.

tags | advisory, vulnerability, xxe
advisories | CVE-2017-10668, CVE-2017-10669, CVE-2017-10670
SHA-256 | e836d90008122100e3bb9c8d79986aeef8cdb8cc46a5f5f505ce7a6396d60f8e
Cisco Prime Infrastructure 3.1.6 XXE Injection / XSS / LFD / SQL Injection
Posted Jun 22, 2017
Authored by P. Morimoto | Site sec-consult.com

Cisco Prime Infrastructure versions 1.1 through 3.1.6 suffer from cross site scripting, XML external entity injection, file disclosure, and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, xss, sql injection, xxe
systems | cisco
advisories | CVE-2017-6662, CVE-2017-6698, CVE-2017-6699, CVE-2017-6700
SHA-256 | b99dc34bb1d4f4d0e0a2ab8dce19e42ad7671744eb78f870180c5ae19b9036d4
Subsonic 6.1.1 XML External Entity Attack
Posted Jun 3, 2017
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Subsonic 6.1.1 import playlist feature is susceptible to an XML External Entity attack via import of a malicious .XSPF playlist file.

tags | exploit, xxe
advisories | CVE-2017-9355
SHA-256 | 1785d67006592ca1aebed74e108868e2aadc2c36f565e3ed4e6a0527106e6ae0
Trend Micro Deep Security 6.5 XXE / Code Execution
Posted May 31, 2017
Site securiteam.com

Trend Micro Deep Security version 6.5 suffers from XML external entity injection, local privilege escalation, and remote code execution vulnerabilities.

tags | exploit, remote, local, vulnerability, code execution, xxe
SHA-256 | 7734e239114061512b4ac1ebb3b04a639de98f84e9b038a1c584b34f794fd8ce
Page 1 of 11
Back12345Next

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    14 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close