Moderate: Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.2 update

Red Hat JBoss BRMS 6.1.2, which fixes two security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

Moderate: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.2 update

Red Hat JBoss BPM Suite 6.1.2, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores...

Camel: XXE via XPath expression evaluation

It was found that Apache Camel performed XML External Entity XXE expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and...

Camel: XXE in via SAXSource expansion

It was found that Apache Camel's XML converter performed XML External Entity XXE expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

Apache Camel 'converter/jaxp/XmlConverter.java' Information Disclosure Vulnerability

Apache Camel is based on the known enterprise-class integration model on the open source integration framework . Multiple XML XXE vulnerabilities exist in the XML converter settings within converter/jaxp/XmlConverter.java in Apache Camel versions prior to 2.13.4, 2.14.2 and prior to 2.14.2, which...

CVE-2015-0264

Multiple XML external entity XXE vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML 1 String or 2 GenericFile object in an XPath query...

CVE-2015-0263

XML external entity XXE vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource...

Xxe

XML external entity XXE vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource...

Xxe

Multiple XML external entity XXE vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML 1 String or 2 GenericFile object in an XPath query...

CVE-2015-0263

Apache Camel contains an XXE in the XML converter setup (converter/jaxp/XmlConverter.java) affecting versions before 2.13.4 and 2.14.x before 2.14.2, allowing remote attackers to read arbitrary files via an external entity in SAXSource. Remediation: upgrade to Camel 2.13.4+ or 2.14.2+. Exploitati...

CVE-2015-0263

XML external entity XXE vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource...

CVE-2015-0264

Multiple XML external entity XXE vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML 1 String or 2 GenericFile object in an XPath query...

CVE-2015-0264

CVE-2015-0264: In Apache Camel, multiple XXE vulnerabilities exist in builder/xml/XPathBuilder.java that allow reading arbitrary files when processing invalid XML strings or GenericFile objects via an XML External Entity (XXE) declaration. Affected versions are Camel before 2.13.4 and 2.14.x befo...

Moderate: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 update

Red Hat JBoss Fuse and A-MQ 6.1.0 Patch 4 on Rollup Patch 2 R2P4, which fixes two security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerabilit...

Camel: XXE in via SAXSource expansion

It was found that Apache Camel's XML converter performed XML External Entity XXE expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

Camel: XXE via XPath expression evaluation

It was found that Apache Camel performed XML External Entity XXE expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and...

Apache Camel XPath Arbitrary File Read Vulnerability

Apache Camel is an open source project under the Apache Foundation , it is a rule-based routing and mediation engine that provides an enterprise integration model of the implementation of the Java object , through the application program interface or known as declarative Java domain-specific...

Cellular Privacy, SS7 Security Shattered at 31C3

The recently concluded Chaos Communications Congress 31c3 in Hamburg, Germany was an all-out assault on cellular call privacy and security. Of particular interest was the SS7 protocol used to route calls between switching centers. Researchers, doing parallel research as it turns out, found gaping...

Apache Camel XSLT Component Java Code Execution (CVE-2014-0003)

A code execution vulnerability has been reported in Apache Camel. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted XML message to the vulnerable server. Successful exploitation could result in the execution of arbitrary Java code...

Camel: XML eXternal Entity (XXE) flaw in XSLT component

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...