Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
xpath injection vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2023-26261
In UBIKA WAAP Gateway/Cloud up to and including 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15.
Ubikasec Waap Gateway
Ubikasec Waap Cloud
Ubikasec Waap Gateway 6.5.6
Ubikasec Waap Cloud 6.5.6
445
VMScore
CVE-2015-5970
The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote malicious users to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.
Novell Zenworks Configuration Management 11.4.0
Novell Zenworks Configuration Management 11.3.2
Novell Zenworks Configuration Management 11.3.1
Novell Zenworks Configuration Management 11.3.0
Novell Zenworks Configuration Management 11.4.1
694
VMScore
CVE-2020-25162
A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and previous versions, and the Data module compactplus Versions A10 and A11 allows unauthenticated remote malicious users to access sensitive information and escalate privileges.
Bbraun Datamodule Compactplus A10
Bbraun Datamodule Compactplus A11
Bbraun Spacecom
490
VMScore
CVE-2013-0505
IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.
Ibm Sterling Selling And Fulfillment Foundation 9.2.0
Ibm Sterling Selling And Fulfillment Foundation 9.1.0
Ibm Sterling Selling And Fulfillment Foundation 9.0
Ibm Sterling Selling And Fulfillment Foundation 8.5
Ibm Sterling Multi-channel Fulfillment Solution 8.0
NA
CVE-2022-22243
An XPath Injection vulnerability due to Improper Input Validation in the J-Web component of Juniper Networks Junos OS allows an authenticated malicious user to add an XPath command to the XPath stream, which may allow chaining to other unspecified vulnerabilities, leading to a pa...
Juniper Junos 19.1
Juniper Junos 19.2
Juniper Junos 19.3
Juniper Junos 19.4
Juniper Junos 20.1
Juniper Junos
Juniper Junos 20.2
Juniper Junos 20.3
Juniper Junos 20.4
Juniper Junos 21.1
Juniper Junos 21.2
Juniper Junos 21.3
Juniper Junos 21.4
Juniper Junos 22.1
490
VMScore
CVE-2012-2596
The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection"...
Siemens Wincc 7.0
570
VMScore
CVE-2014-1409
MobileIron VSP versions before 5.9.1 and Sentry versions before 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords
Mobileiron Virtual Smartphone Platform
Mobileiron Sentry
356
VMScore
CVE-2016-9149
The Addresses Object parser in Palo Alto Networks PAN-OS prior to 5.0.20, 5.1.x prior to 5.1.13, 6.0.x prior to 6.0.15, 6.1.x prior to 6.1.15, 7.0.x prior to 7.0.11, and 7.1.x prior to 7.1.6 mishandles single quote characters, which allows remote authenticated users to conduct XP...
Paloaltonetworks Pan-os
668
VMScore
CVE-2019-8158
An XPath entity injection vulnerability exists in Magento 2.2 before 2.2.10, Magento 2.3 before 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET...
Magento Magento
Magento Magento 2.3.2
NA
CVE-2022-22244
An XPath Injection vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker sending a crafted POST to reach the XPath channel, which may allow chaining to other unspecified vulnerabilities, leading to a partial loss of confidentiality. ...
Juniper Junos 19.1
Juniper Junos 19.2
Juniper Junos 19.3
Juniper Junos 19.4
Juniper Junos 20.1
Juniper Junos
Juniper Junos 20.2
Juniper Junos 20.3
Juniper Junos 20.4
Juniper Junos 21.1
Juniper Junos 21.2
Juniper Junos 21.3
Juniper Junos 21.4
Juniper Junos 22.1
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-2907
hardcoded
inject
CVE-2024-20359
CVE-2024-2467
CVE-2024-4077
CVE-2024-22391
camera
CVE-2024-20353
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
NEXT »