CWE-91 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-91/ Sun, 26 Feb 2023 09:10:49 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-91 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-91/ 32 32 CVE-2008-5024 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-5024/ Sun, 26 Feb 2023 09:10:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-5024/ Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.

The post CVE-2008-5024 appeared first on CVE Vulnerability.

]]> Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.

The post CVE-2008-5024 appeared first on CVE Vulnerability.

]]> CVE-2018-2477 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-2477/ Sun, 26 Feb 2023 06:49:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-2477/ Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source.

The post CVE-2018-2477 appeared first on CVE Vulnerability.

]]> Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source.

The post CVE-2018-2477 appeared first on CVE Vulnerability.

]]> CVE-2018-19277 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-19277/ Sun, 26 Feb 2023 06:48:06 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-19277/ securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

The post CVE-2018-19277 appeared first on CVE Vulnerability.

]]> securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

The post CVE-2018-19277 appeared first on CVE Vulnerability.

]]> CVE-2018-1721 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1721/ Sun, 26 Feb 2023 06:47:22 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1721/ IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or cause the web server to make HTTP requests to arbitrary domains. IBM X-Force ID: 147369.

The post CVE-2018-1721 appeared first on CVE Vulnerability.

]]> IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or cause the web server to make HTTP requests to arbitrary domains. IBM X-Force ID: 147369.

The post CVE-2018-1721 appeared first on CVE Vulnerability.

]]> CVE-2018-16785 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-16785/ Sun, 26 Feb 2023 06:47:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-16785/ XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell

The post CVE-2018-16785 appeared first on CVE Vulnerability.

]]> XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell

The post CVE-2018-16785 appeared first on CVE Vulnerability.

]]> CVE-2018-16784 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-16784/ Sun, 26 Feb 2023 06:47:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-16784/ DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a “<file type='file' name='../" substring.

The post CVE-2018-16784 appeared first on CVE Vulnerability.

]]> DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a “<file type='file' name='../" substring.

The post CVE-2018-16784 appeared first on CVE Vulnerability.

]]> CVE-2018-1000632 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1000632/ Sun, 26 Feb 2023 06:44:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1000632/ dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed […]

The post CVE-2018-1000632 appeared first on CVE Vulnerability.

]]> dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

The post CVE-2018-1000632 appeared first on CVE Vulnerability.

]]> CVE-2018-1000526 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1000526/ Sun, 26 Feb 2023 06:44:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1000526/ Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26.

The post CVE-2018-1000526 appeared first on CVE Vulnerability.

]]> Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26.

The post CVE-2018-1000526 appeared first on CVE Vulnerability.

]]> CVE-2020-8479 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8479/ Sun, 26 Feb 2023 06:43:25 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8479/ For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and […]

The post CVE-2020-8479 appeared first on CVE Vulnerability.

]]> For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5. an XML External Entity Injection vulnerability exists that allows an attacker to read or call arbitrary files from the license server and/or from the network and also block the license handling.

The post CVE-2020-8479 appeared first on CVE Vulnerability.

]]> CVE-2020-6271 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-6271/ Sun, 26 Feb 2023 06:42:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-6271/ SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the system to crash and read restricted data (files visible for technical administration users of the diagnostics agent).

The post CVE-2020-6271 appeared first on CVE Vulnerability.

]]> SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the system to crash and read restricted data (files visible for technical administration users of the diagnostics agent).

The post CVE-2020-6271 appeared first on CVE Vulnerability.

]]>