SOAP XML Injection

Home/Alerts/Alert detail/

Risk:
High

Type:
Active

Summary: Some XML injected code has been interpreted by the server.

Solution: Use a detailed description of SOAP attributes in the WSDL file.

Other info: Some XML injected code has been interpreted by the server.

References: https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2012/07/11/camera-ready.pdf

Top Security News

CISA orders federal agencies to secure Microsoft 365 tenants

Recorded Future CEO applauds "undesirable" designation by Russia

BeyondTrust fixes critical vulnerability in remote access, support solutions (CVE-2024-12356)

Google Chrome uses AI to analyze pages in new scam detection feature

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

Exploit released for critical WhatsUp Gold RCE flaw, patch now

Microsoft fixes exploited zero-day (CVE-2024-49138)

Common Alerts

MediumDirectory Browsing

MediumReverse Tabnabbing

LowCookie with Invalid SameSite Attribute

MediumSource Code Disclosure - SVN

HighPII Disclosure

HighServer Side Request Forgery

MediumCORS Misconfiguration

HighExternal Redirect

InformationalCharset Mismatch

MediumXSLT Injection

Top CVE List

CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability

CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability

CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CVE-2023-36884 Microsoft Windows Search Remote Code Execution Vulnerability

CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2020-5849 Unraid Authentication Bypass Vulnerability

CVE-2024-43451 Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

Common CWEs

CWE-1264 Hardware Logic with Insecure De-Synchronization between Control and Data Channels

HighCWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-303 Incorrect Implementation of Authentication Algorithm

HighCWE-499 Serializable Class Containing Sensitive Data

MediumCWE-128 Wrap-around Error

CWE-295 Improper Certificate Validation

CWE-138 Improper Neutralization of Special Elements

CWE-1241 Use of Predictable Algorithm in Random Number Generator

CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CWE-1311 Improper Translation of Security Attributes by Fabric Bridge

Free security scan for your website

Don't show website scan report rating on the leaderboard