Xxe

The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion XXE attacks to disclose host machine...

CVE-2018-5434 XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent

The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion XXE attacks to disclose host machine information. Affected releases are TIBCO Software Inc.'...

CVE-2018-5434

The CVE-2018-5434 issue affects TIBCO Runtime Agent (including TIBCO Designer) and the TIBCO Runtime Agent for z/Linux. The root cause is XML external entity (XXE) expansion, allowing a malicious user to disclose host machine information. Affected releases include TIBCO Runtime Agent up to 5.10.0...

CVE-2018-5433 XML eXternal Entity Expansion Vulnerabilities with TIBCO Administrator

The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion XXE attacks to disclose host machine...

UBUNTU-CVE-2017-16129

The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive...

TIBCO Security Advisory: June 12, 2018 - TIBCO Runtime Agent -2018-5434

XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent Original release date: June 12,2018 Last revised: -- CVE-2018-5434 Source: TIBCO Software Inc. XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent Original release date: June 12, 2018 Last revised: -- Source...

PT-2018-4720 · Npm · Shell-Quote

Name of the Vulnerable Software and Affected Versions: shell-quote versions 1.6.0 and earlier Description: The issue affects the npm module "shell-quote" and allows for code injection due to incorrect escaping of certain characters, including , , ;, , and . This can lead to command injection if t...

Prowler - Distributed Network Vulnerability Scanner

Prowler is a Network Vulnerability Scanner implemented on a Raspberry Pi Cluster, first developed during Singapore Infosec Community Hackathon - HackSmith v1.0. Capabilities Scan a network a particular subnet or a list of IP addresses for all IP addresses associated with active network devices...

Xxe

This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion XXE in Solr config files solrconfig.xml, schema.xml, managed-schema. In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability...

CVE-2018-8010

This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion XXE in Solr config files solrconfig.xml, schema.xml, managed-schema. In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability...

DNS-Hijacking Malware Targeting iOS, Android and Desktop Users Worldwide

Widespread routers' DNS hijacking malware that recently found targeting Android devices has now been upgraded its capabilities to target iOS devices as well as desktop users. Dubbed Roaming Mantis, the malware was initially found hijacking Internet routers last month to distribute Android banking...

New State of Online Retail Performance Report Available

It's springtime, and the only people with the holidays on their minds are in the retail business. This holiday season was a record-breaking one, with combined revenue for Black Friday and Cyber Monday alone exceeding $11.5 billion. To build on that momentum, smart retailers will take a closer loo...

jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)

A deserialization flaw was discovered in the jackson-databind that could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaws CVE-2017-7525 and CVE-2017-17485 by...

Apache Solr Data Import Handler XML External Entity Expansion Information Disclosure (CVE-2018-1308)

An XML external entity expansion vulnerability has been reported in Apache Solr. The vulnerability is due to improper handling of XML external entities in XML content submitted to the DataImportHandler. A remote attacker can exploit this vulnerability by submitting a crafted request to the target...

[SECURITY] [DLA 1360-1] lucene-solr security update

Package : lucene-solr Version : 3.6.0+dfsg-1+deb7u4 CVE ID : CVE-2018-1308 Debian Bug : 896604 It was discovered that there was an XML external entity expansion XXE vulnerability in lucene-solr, a search engine library for Java. It could be exploited to read arbitrary local files from the Solr...

Debian: Security Advisory (DLA-1360-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Office: Disable Smart Documents use of manifests

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013documentmanifest.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Disable Smart Document's use of manifests Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net...

gcc security, bug fix, and enhancement update

4.8.5-28.0.1 - Orabug: 27557686 Egeyar Bagcioglu - Introduce 'oraclerelease' into .spec file. Echo it to gcc/DEV-PHASE. 4.8.5-28 - Minor testsuite fixes to clean up test results 1469697 - retpoline support for spectre mitigation 1535655 4.8.5-27 - bump for rebuild with RELRO enabled even for...

glibc: Buffer overflow in glob with GLOB_TILDE

The GNU C Library aka glibc or libc6 before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the operator followed by a long string...

CVE-2018-1308

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion XXE in the &dataConfig= parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the...