XML External Entity Injection (XXE)

org.xwiki.commons:xwiki-commons-xml is vulnerable to XML external entity injection XXE. A remote authenticated attacker is able to inject a specifically crafted script through the XML script service to gain access to sensitive user information...

CVE-2022-24898

CVE-2022-24898 affects org.xwiki.commons:xwiki-commons-xml, a common module used by XWiki projects. The issue is XML External Entity Injection via the XML script service, allowing a script to access files on the user running the XWiki server. Affected: 2.7 up to but not including patched versions...

CVE-2022-24898 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External...

GHSA-M2R5-4W96-QXG5 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

Impact It's possible in a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. For example: velocity set$xml=$services.get'xml' set$xxepayload = "" set$doc=$xml.parse$xxepayload $xml.serialize$doc...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management

Summary IBM WebSphere Application Server traditional is vulnerable to an XML External Entity XXE Injection vulnerability Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injectio...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management

Summary WebSphere Application Server traditional is vulnerable to an XML External Entity XXE Injection vulnerability Vulnerability Details CVEID: CVE-2021-20453 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection XXE attack when...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - IBM WebSphere Application Server (CVE-2021-20492)

Summary Security Vulnerabilities affect IBM Cloud Private - IBM WebSphere Application Server Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection XXE attack when processing...

FANUC ROBOGUIDE XML External Entity Injection Vulnerability

FANUC ROBOGUIDE is a robot simulation software from FANUC Japan. FANUC ROBOGUIDE v9.40083.00.05 and earlier versions exist XML external entity injection vulnerability, which originates from the lack of application restrictions on external entities. An attacker could exploit this vulnerability to...

Security Bulletin: Information disclosure for IBM Infosphere Global Name Management

Summary There is a potential information disclosure vulnerability in Global Name Management when using Enterprise Name Search. The information disclosure is due to an XML external entity XXE vulnerability. Customers not using Enterprise Name Search are not affected. Vulnerability Details CVEID:...

XML External Entity (XXE) Injection

fr.opensagres.xdocreport:fr.opensagres.xdocreport.document is vulnerable to XML external entity XXE injection attacks. A remote attacker is able to inject malicious XML input via a weakly configured XML parser in the preprocess function...

FANUC ROBOGUIDE 代码问题漏洞

FANUC ROBOGUIDE is a robot simulation software from FANUC Japan. FANUC ROBOGUIDE v9.40083.00.05 and earlier versions exist XML external entity injection vulnerability, which originates from the lack of application restrictions on external entities. An attacker could exploit this vulnerability to...

SAP BusinessObjects Business Intelligence Platform XML外部实体注入漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP Germany. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and enable...

Jenkins Flaky Test Handler Plugin XML External Entity Injection Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Flaky Test Handler Plugin 1.2.1...

Jenkins Pipeline Phoenix AutoTest Plugin XML External Entity Injection Vulnerability

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.The Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier versions are vulnerable to XML external entity injection, which can be exploited by remote attackers to...

Jenkins Pipeline 代码问题漏洞

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.The Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier versions are vulnerable to XML external entity injection, which can be exploited by remote attackers to...

Jenkins Coverage/Complexity Scatter Plot Plugin 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An XML external entity injection...

jdom: XXE allows attackers to cause a DoS via a crafted HTTP request

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request...

CVE-2022-25312

An XML external entity XXE injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions 2.7. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's...

Security Bulletin: OpenSource Apache Taglibs vulnerability affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) CVE-2015-0254

Summary OpenSource Apache Taglibs vulnerability affects IBM Spectrum Control and Tivoli Storage Productivity Center. IBM Spectrum Control and Tivoli Storage Productivity Center have addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs coul...

Jenkins Chef Sinatra Plugin XML External Entity Injection Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins Chef Sinatra Plugin XML External Entity Injection vulnerability. An attacker can use this vulnerability to allow Jenkins to parse a crafted XML response to extract secrets...