Alexey Osipov

The issue is related to a XML external entity (XXE) exploit. This type of issue occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser, allowing access to files that should not normally be accessible through file URI schemes or relative paths in the system identifier.

The issue is related to an authentication bypass exploit, which can allow attackers to potentially circumvent security mechanisms and gain access to the system or network.

An Improper Input Validation issue affects a service within the software, potentially allowing a remote attacker to arbitrarily read or access system resources and impact the system's availability. The vulnerability exists due to insufficient input validation, which can be exploited by a remote attacker to gain read access to arbitrary system resources and affect system availability.

An issue was discovered where user credentials are sent to the web server in clear text. This may allow an attacker to discover the credentials if they are able to observe traffic between the web browser and the server. The vulnerability is related to the lack of protection for service data, which can be exploited by a remote attacker to obtain user credentials in unencrypted form by eavesdropping on traffic between the browser and the server.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service through CPU and memory consumption. This is related to an XML External Entity (XXE) issue, where an XML document containing an external entity declaration in conjunction with an entity reference can be used for exploitation.

The issue allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.

An issue exists in the way Microsoft Excel parses specially crafted XML files, allowing remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference. This is related to an XML External Entity (XXE) issue, which is an information disclosure vulnerability.

The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. The vulnerability is also associated with insufficient access restrictions to certain functions, which can be exploited by an attacker to achieve similar malicious outcomes.

The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

The issue allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service due to CPU and memory consumption. This is achieved via an XML external entity declaration in conjunction with an entity reference.