The vulnerability of the Splunk Enterprise platform for operational analysis, related to errors in processing XML requests, allows a perpetrator to execute arbitrary code.

The vulnerability of the Splunk Enterprise platform for operational analysis is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Adobe RoboHelp Security Vulnerability

Adobe RoboHelp is a software application from Adobe, Inc. Next-generation software for authoring and publishing help, strategy and knowledge base content. A security vulnerability exists in Adobe RoboHelp version 11.4 and prior versions, which stems from the presence of an XML External Entity...

CVE-2022-34832

An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component...

CVE-2022-34832

An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component...

PT-2023-28883 · Unknown · Cx-Designer

Name of the Vulnerable Software and Affected Versions: CX-Designer versions 3.740 and earlier Description: The issue concerns an improper restriction of XML external entity reference XXE vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information ...

CVE-2023-45727

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity XXE attacks. By processing a specially crafted request containing...

The vulnerability of the addDv7Probe function in the D-View 8 network device management platform allows a hacker to gain unauthorized access to protected information.

The vulnerability of the addDv7Probe function in the D-View 8 network device management platform is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the PHP programming language interpreter arises from incorrect restrictions on XML links to external objects. This allows attackers to trigger service failures or gain unauthorized access to confidential data.

The vulnerability of the PHP programming language interpreter is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow an attacker to cause service failures or gain unauthorized access to confidential data...

DEBIAN-CVE-2023-42445

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack OOB-XXE, just parsing XML can lead to exfiltration of local tex...

The vulnerability of the EcoStruxure OPC UA Server Expert software, a software tool for managing industrial processes, arises from incorrect restrictions on XML references to external objects. This allows attackers to access confidential information.

The vulnerability of the industrial process management software EcoStruxure OPC UA Server Expert is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability may allow an attacker to access confidential information...

Improper restriction of XML external entity references (XXE) in FD Application

Overview FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references XXE CWE-611. Toyama Taku and Sakaki Ryutaro of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...

The vulnerability of the SetAPLanSettings function in the microprogramming software of the D-Link DAP-1325 wireless signal booster allows a intruder to execute arbitrary code.

The vulnerability of the SetAPLanSettings function in the microprogramming software of the D-Link DAP-1325 wireless signal booster is related to the execution of operations outside the buffer in memory when processing XML data. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability of the microprogramming software for routers PHOENIX CONTACT TC ROUTER, TC CLOUD CLIENT, and CLOUD CLIENT arises from incorrect restrictions on XML links to external objects. This allows attackers to cause service failures.

The vulnerability of the microprogramming software for routers PHOENIX CONTACT TC ROUTER, TC CLOUD CLIENT, and CLOUD CLIENT is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failur...

The vulnerability of the SetAPLanSettings function in the microprogramming software of the D-Link DAP-1325 wireless signal booster allows a intruder to execute arbitrary code.

The vulnerability of the SetAPLanSettings function in the microprogramming software of the D-Link DAP-1325 wireless signal booster is related to the execution of operations outside the buffer in memory when processing XML data. Exploiting this vulnerability allows a remote attacker to execute...

CLSA-2023-1695834624 python3: Fix of 2 CVEs

CVE-2021-3177: Replace snprintf to prevent buffer overflow - CVE-2022-48565: Reject XML entity declarations in plist files...

The vulnerability of the “links” function in the Cacti network monitoring software allows a hacker to execute arbitrary SQL queries.

The vulnerability of the “links” function in the Cacti network monitoring software is related to the lack of validation for the sequences of XML objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability in the software web interface for processing and transmitting confidential data of Progress MOVEit Transfer lies in the lack of validation for XML objects’ sequences, allowing an intruder to gain unauthorized access to the MOVEit Transfer database.

The vulnerability of the software web interface for processing and transmitting confidential data in Progress MOVEit Transfer is related to the lack of verification of the validity of XML objects. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access...

UBUNTU-CVE-2023-3550

Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator...

The vulnerability of the binary data management service of the software solution allows a perpetrator to execute arbitrary code.

The vulnerability of the binary data management service of the software solution relates to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with administrative privileges by sending a specially crafted Java object in...

GHSA-8CJG-F53M-8M9Q Magento XML Injection vulnerability in the Widgets Update Layout

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...