SOAP XML Injection

Home/Alerts/Alert detail/

Risk:
High

Type:
Active

Summary: Some XML injected code has been interpreted by the server.

Solution: Use a detailed description of SOAP attributes in the WSDL file.

Other info: Some XML injected code has been interpreted by the server.

References: https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2012/07/11/camera-ready.pdf

Latest Security News

Canada Orders TikTok to Shut Down Canadian Operations Over Security Concerns

Hackers increasingly use Winos4.0 post-exploitation kit in attacks

Microsoft Notepad to get AI-powered rewriting tool on Windows 11

Cisco bug lets hackers run commands as root on UWRB access points

New SteelFox malware hijacks Windows PCs using vulnerable driver

VEILDrive Attack Exploits Microsoft Services to Evade Detection and Distribute Malware

Washington courts' systems offline following weekend cyberattack

Germany drafts law to protect researchers who find security flaws

Common Alerts

LowInformation Disclosure - Debug Error Messages via WebSocket

InformationalCSP: Header & Meta

MediumSource Code Disclosure - SVN

HighExternal Redirect

InformationalSec-Fetch-User Header Has an Invalid Value

HighSource Code Disclosure - Git

MediumApplication Error Disclosure

HighSQL Injection - MySQL

InformationalHTTP Parameter Pollution

InformationalInformation Disclosure - Suspicious Comments in XML via WebSocket

Top CVE List

CVE-2024-38094 Microsoft SharePoint Deserialization Vulnerability

CVE-2022-3075 Google Chromium Mojo Insufficient Data Validation Vulnerability

CVE-2024-8957 PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

CVE-2024-37383 RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

CVE-2024-20481 Cisco ASA and FTD Denial-of-Service Vulnerability

CVE-2024-8956 PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

CVE-2020-3452 Cisco ASA and FTD Read-Only Path Traversal Vulnerability

CVE-2020-3837 Apple Multiple Products Memory Corruption Vulnerability

CVE-2021-34486 Microsoft Windows Event Tracing Privilege Escalation Vulnerability

CVE-2022-22948 VMware vCenter Server Incorrect Default File Permissions Vulnerability

Common CWEs

CWE-536 Servlet Runtime Error Message Containing Sensitive Information

CWE-35 Path Traversal: '.../...//'

CWE-1092 Use of Same Invokable Control Element in Multiple Architectural Layers

CWE-1066 Missing Serialization Control Element

CWE-495 Private Data Structure Returned From A Public Method

CWE-430 Deployment of Wrong Handler

CWE-105 Struts: Form Field Without Validator

CWE-1284 Improper Validation of Specified Quantity in Input

CWE-683 Function Call With Incorrect Order of Arguments

CWE-412 Unrestricted Externally Accessible Lock

Free security scan for your website

Don't show website scan report rating on the leaderboard