Evgeny Ermakov

A Command Injection issue allows a remote attacker to execute arbitrary code on a target machine with elevated privileges. The vulnerability is related to the incorrect neutralization of special elements used in a command, which can be exploited by a remote attacker to elevate privileges and execute arbitrary code.

An issue was discovered that allows an attacker to enter malicious input through a weakly configured XML parser, causing the application to execute arbitrary code or disclose file contents from a server or connected network.

The issue is related to an XML External Entity (XXE) problem, which is caused by incorrect restriction of XML links to external objects. This can allow a remote attacker to gain access to confidential information by using specially crafted XML requests. An attacker may enter malicious input to Liebert SiteScan through a weakly configured XML parser, causing the application to execute arbitrary code or disclose file contents from a server or connected network.

The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, due to improper document generation by darkfish.js in RDoc.