CVE-2018-13417

In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Vuze, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.

• CWE-611

• http://seclists.org/fulldisclosure/2018/Aug/2Exploit, Mailing List, Technical Description, Third Party Advisory
• https://www.exploit-db.com/exploits/45145/Exploit, Technical Description, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Aug/2Exploit, Mailing List, Technical Description, Third Party Advisory
• https://www.exploit-db.com/exploits/45145/Exploit, Technical Description, Third Party Advisory, VDB Entry

Published

Aug 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-13409An issue was discovered in Jirafeau before 3.4.1. The "searc…
• CVE-2018-13410Info-ZIP Zip 3.0, when the -T and -TT command-line options a…
• CVE-2018-13411An issue was discovered in Zoho ManageEngine Desktop Central…
• CVE-2018-13412An issue was discovered in the Self Service Portal in Zoho M…
• CVE-2018-13415In Plex Media Server 1.13.2.5154, the XML parsing engine for…
• CVE-2018-13416In Universal Media Server (UMS) 7.1.0, the XML parsing engin…
• CVE-2018-13418System command injection in ajaxdata.php in TerraMaster TOS …
• CVE-2018-13419An issue has been found in libsndfile 1.0.28. There is a mem…
• CVE-2018-1342A Vulnerability exists on Admin Console where an attacker ca…
• CVE-2018-13420Google gperftools 2.7 has a memory leak in malloc_extension.…
• CVE-2018-13421Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07…
• CVE-2018-13422TCExam before 14.1.2 has XSS via an ff_ or xl_ field.