Full title: Ladon Framework For Python 0.9.40 XXE Injection Vulnerability 
Category: web applications
Platform: python
Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service with exponentially growing memory payloads. Versions 0.9.40 and below are affected.

# 0day.today @ http://0day.today/