This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Missing XML Validation"

From OWASP
Jump to: navigation, search
m
 
(8 intermediate revisions by 3 users not shown)
Line 1: Line 1:
[http://s1.shard.jp/galeach/new77.html kitty asian movies
 
] [http://s1.shard.jp/olharder/agencias-auto.html autonetusa.com carfinder
 
] [http://s1.shard.jp/olharder/automatic-watch.html automotive supply chain
 
] [http://s1.shard.jp/galeach/new100.html tsunami diaster in asia
 
] [http://s1.shard.jp/losaul/business-services.html australia sydney tours
 
] [http://s1.shard.jp/galeach/new194.html adventure asia international
 
] [http://s1.shard.jp/losaul/australian-residency.html sydney australia apartments for rent
 
] [http://s1.shard.jp/losaul/car-hire-brisbane.html australian animal habitats
 
] [http://s1.shard.jp/frhorton/y8fj1syi7.html 2006 african cup nation
 
] [http://s1.shard.jp/losaul/how-to-train.html barrick gold australia
 
] [http://s1.shard.jp/losaul/australian-music.html australian music charts archives] [http://s1.shard.jp/losaul/australia-cost.html 2004 cpi australia
 
] [http://s1.shard.jp/galeach/new80.html europe asia border map
 
] [http://s1.shard.jp/bireba/ dod antivirus download
 
] [http://s1.shard.jp/olharder/wes-finch-auto-plaza.html auto sketch 9
 
] [http://s1.shard.jp/olharder/autobiography.html best auto body san francisco
 
] [http://s1.shard.jp/olharder/auto-benz-dealer.html download autodesk architectural desktop
 
] [http://s1.shard.jp/olharder/buy-and-sell-autos.html auction auto charlotte
 
] [http://s1.shard.jp/frhorton/eob9cf6xd.html jojoba cultivation south africa
 
] [http://s1.shard.jp/losaul/lawn-bowls-clubs.html cheap auto parts australia buy online
 
] [http://s1.shard.jp/galeach/new109.html dynasties in asia
 
] [http://s1.shard.jp/bireba/symantec-antivirus.html dod antivirus download
 
] [http://s1.shard.jp/bireba/avg-antivirus-linux.html serial for avg antivirus 7.1
 
] [http://s1.shard.jp/losaul/australian-laws.html home and away australian soap opera
 
] [http://s1.shard.jp/losaul/australian-hotel.html tikatec australia
 
] [http://s1.shard.jp/frhorton/2wh6r9nyq.html african quenn screenwriter
 
] [http://s1.shard.jp/galeach/new116.html asian cute girl myspace.com site
 
] [http://s1.shard.jp/olharder/colorado-auto.html new zealand automobile club
 
] [http://s1.shard.jp/bireba/panda-titanium.html antivirus avg7.0
 
] [http://s1.shard.jp/olharder/auto-calculator.html auto turret
 
] [http://s1.shard.jp/olharder/autonomy-principal.html lakeland auto mall lakeland fl
 
] [http://s1.shard.jp/galeach/new135.html asian massage chicago illinois
 
] [http://s1.shard.jp/galeach/new5.html walt disneys fantasia pictures
 
] [http://s1.shard.jp/losaul/australian-census.html virgin air lines australia
 
] [http://s1.shard.jp/bireba/mcafee-free-antivirus.html mcafee free antivirus software] [http://s1.shard.jp/frhorton/h4xwn2n8q.html africa corps peace south] [http://s1.shard.jp/galeach/new137.html asian asses
 
] [http://s1.shard.jp/frhorton/41nbv47ei.html africa book centre london] [http://s1.shard.jp/bireba/escan-antivirus.html kasperski antivirus program
 
] [http://s1.shard.jp/frhorton/jp87fttqi.html african american inventor modern
 
] [http://s1.shard.jp/losaul/emmigrating-australia.html import goods to australia
 
] [http://s1.shard.jp/galeach/new138.html edge x asians
 
] [http://s1.shard.jp/frhorton/y9my6dqry.html african cosmology metaphysics
 
] [http://s1.shard.jp/olharder/autoroll-654.html top] [http://s1.shard.jp/frhorton/3l77ipk2f.html occupational health and safety government agencies africa
 
] [http://s1.shard.jp/bireba/symantec-antivirus.html update antivirus software
 
] [http://s1.shard.jp/galeach/new112.html paper rose boxes from asia
 
] [http://s1.shard.jp/losaul/australia-transcriber.html asian study association australia
 
 
http://www.textdarvarliace.com
 
 
{{Template:Vulnerability}}
 
{{Template:Vulnerability}}
{{Template:Fortify}}
 
  
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
+
 
 +
Last revision (mm/dd/yy): 2009
 +
 
 +
Last page edit: '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
  
 
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
Line 97: Line 54:
  
 
==References==
 
==References==
Note: A reference to related [http://cwe.mitre.org/ CWE] or [http://capec.mitre.org/ CAPEC] article should be added when exists. Eg:
+
TODO
 
 
* [http://cwe.mitre.org/data/definitions/79.html CWE 79].
 
* http://www.link1.com
 
* [http://www.link2.com Title for the link2]
 
 
 
  
 
__NOTOC__
 
__NOTOC__

Latest revision as of 09:48, 7 December 2015

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


Last revision (mm/dd/yy): 2009

Last page edit: 12/7/2015

Vulnerabilities Table of Contents

Description

Failure to enable validation when parsing XML gives an attacker the opportunity to supply malicious input.

Most successful attacks begin with a violation of the programmer's assumptions. By accepting an XML document without validating it against a DTD or XML schema, the programmer leaves a door open for attackers to provide unexpected, unreasonable, or malicious input. It is not possible for an XML parser to validate all aspects of a document's content; a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document's structure and therefore guarantee to the code that processes the document that the content is well-formed.


Risk Factors

  • Talk about the factors that make this vulnerability likely or unlikely to actually happen
  • Discuss the technical impact of a successful exploit of this vulnerability
  • Consider the likely [business impacts] of a successful attack


Examples

Short example name

A short example description, small picture, or sample code with links

Short example name

A short example description, small picture, or sample code with links


Related Attacks


Related Vulnerabilities

Related Controls


Related Technical Impacts


References

TODO