Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
xpath injection vulnerabilities and exploits
(subscribe to this query)
5
CVSSv2
CVE-2015-5970
The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote malicious users to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.
Novell Zenworks Configuration Management 11.4.0
Novell Zenworks Configuration Management 11.3.2
Novell Zenworks Configuration Management 11.3.1
Novell Zenworks Configuration Management 11.3.0
Novell Zenworks Configuration Management 11.4.1
4
CVSSv2
CVE-2012-4837
IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.
Ibm Cognos Business Intelligence 10.1
Ibm Cognos Business Intelligence 10.1.1
Ibm Cognos Business Intelligence 10.2
Ibm Cognos Business Intelligence 8.4.1
7.8
CVSSv2
CVE-2020-25162
A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and previous versions, and the Data module compactplus Versions A10 and A11 allows unauthenticated remote malicious users to access sensitive information and escalate privileges.
Bbraun Datamodule Compactplus A10
Bbraun Datamodule Compactplus A11
Bbraun Spacecom
5.5
CVSSv2
CVE-2013-0505
IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.
Ibm Sterling Selling And Fulfillment Foundation 9.2.0
Ibm Sterling Selling And Fulfillment Foundation 9.1.0
Ibm Sterling Selling And Fulfillment Foundation 9.0
Ibm Sterling Selling And Fulfillment Foundation 8.5
Ibm Sterling Multi-channel Fulfillment Solution 8.0
NA
CVE-2022-22243
An XPath Injection vulnerability due to Improper Input Validation in the J-Web component of Juniper Networks Junos OS allows an authenticated malicious user to add an XPath command to the XPath stream, which may allow chaining to other unspecified vulnerabilities, leading to a pa...
Juniper Junos 19.1
Juniper Junos 19.2
Juniper Junos 19.3
Juniper Junos 19.4
Juniper Junos 20.1
Juniper Junos
Juniper Junos 20.2
Juniper Junos 20.3
Juniper Junos 20.4
Juniper Junos 21.1
Juniper Junos 21.2
Juniper Junos 21.3
Juniper Junos 21.4
Juniper Junos 22.1
5.5
CVSSv2
CVE-2012-2596
The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection"...
Siemens Wincc 7.0
6.4
CVSSv2
CVE-2014-1409
MobileIron VSP versions before 5.9.1 and Sentry versions before 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords
Mobileiron Virtual Smartphone Platform
Mobileiron Sentry
4
CVSSv2
CVE-2016-9149
The Addresses Object parser in Palo Alto Networks PAN-OS prior to 5.0.20, 5.1.x prior to 5.1.13, 6.0.x prior to 6.0.15, 6.1.x prior to 6.1.15, 7.0.x prior to 7.0.11, and 7.1.x prior to 7.1.6 mishandles single quote characters, which allows remote authenticated users to conduct XP...
Paloaltonetworks Pan-os
7.5
CVSSv2
CVE-2019-8158
An XPath entity injection vulnerability exists in Magento 2.2 before 2.2.10, Magento 2.3 before 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET...
Magento Magento
Magento Magento 2.3.2
NA
CVE-2022-22244
An XPath Injection vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker sending a crafted POST to reach the XPath channel, which may allow chaining to other unspecified vulnerabilities, leading to a partial loss of confidentiality. ...
Juniper Junos 19.1
Juniper Junos 19.2
Juniper Junos 19.3
Juniper Junos 19.4
Juniper Junos 20.1
Juniper Junos
Juniper Junos 20.2
Juniper Junos 20.3
Juniper Junos 20.4
Juniper Junos 21.1
Juniper Junos 21.2
Juniper Junos 21.3
Juniper Junos 21.4
Juniper Junos 22.1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4040
privilege escalation
CVE-2024-4112
CVE-2024-32872
man-in-the-middle
CVE-2024-32788
bypass
CVE-2024-3400
CVE-2024-28976
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
NEXT »