The vulnerability of the Cisco Secure ACS access control system’s web interface allows a perpetrator to gain access to confidential information.

The vulnerability in the Cisco Secure ACS access control system’s web interface is related to improper processing of external XML entities when working with XML files. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

PT-2019-6341 · D Link · D-Link Dir-818Lw +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-818LW Rev.A version 2.05.B03 D-Link DIR-822 B1 version 202KRb06 Description: The issue affects the /HNAP1/SetRouterSettings message, where the RemotePort parameter is vulnerable. This vulnerability can be exploited by sending a...

XML External Entity Reference in c3p0:c3p0

c3p0 allows XXE during initialization...

XSLT CMS Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in XSLT CMS, a content management system CMS written in PHP and based on XML and XSL transformations. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the title field of the create/?action=items.edit&type=Page...

The vulnerability of the Python programming package, related to errors in resource release, allows a perpetrator to trigger a service failure.

The vulnerability of the Python programming package is related to errors during resource release. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially crafted XML document...

The vulnerability in the web interface of the Cisco Energy Management Suite, related to incorrect restrictions on XML references to external objects (XXE), allows an attacker to disclose or modify sensitive information.

The vulnerability in the web interface of the Cisco Energy Management Suite relates to incorrect restrictions on XML references to external objects XXE. Exploiting this vulnerability could allow an attacker to disclose or modify sensitive information...

The vulnerability of the PI Studio XML development tool analyzer arises from incorrect restrictions on XML references to external objects, allowing attackers to disclose protected information.

The vulnerability of the PI Studio XML analysis tool arises from an incorrect limitation on XML references to external objects. Operating this tool may allow a malicious actor to disclose protected information...

Microsoft SQL Server Management Studio Information Disclosure Vulnerability

Microsoft SQL Server Management Studio is an integrated environment for managing multiple SQL infrastructures from Microsoft. The product is mainly used for setting up, monitoring and managing SQL programs. An information disclosure vulnerability exists in Microsoft SQL Server Management Studio...

CVE-2018-1588

IBM Jazz Foundation IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

CVE-2018-16252

FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection...

DEBIAN-CVE-2018-1000652

JabRef version =4.3.1 contains a XML External Entity XXE vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBib file. This...

ALPINE-CVE-2018-14567

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251...

ALPINE-CVE-2017-2640

An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process...

Fortify Software Security Center (SSC) XXE Vulnerability

Micro Focus Fortify Software Security Center SSC is a software security management platform from Micro Focus UK. A XXE vulnerability exists in Fortify Software Security Center SSC that could allow a remote, unauthenticated user to read arbitrary files or conduct server-side request forgery SSRF...

Microsoft Windows EMET XML External Entity Injection Vulnerability

Microsoft Windows 10 and others are a series of operating systems released by the American company Microsoft Microsoft, Enhanced Mitigation Experience Toolkit is a free security toolkit for Microsoft Windows. An XML external entity injection vulnerability exists in Microsoft Windows EMET, which...

CVE-2018-1000526

Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26...

The vulnerability of the form development tool for data input based on XML, Microsoft InfoPath, arises from errors in object processing in memory, allowing attackers to execute arbitrary code.

The vulnerability of the form development tool for input data based on XML is due to an operation going beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted file...

Microsoft Windows FxCop XML External Entity Injection Vulnerability

Microsoft Windows FxCop is a code review tool for the .net platform. Microsoft Windows FxCop XML External Entity Injection vulnerability, which originates from an external entity injection error when the program processes XML data. A remote attacker could exploit this vulnerability to disclose...

ALC WebCTRL XML External Entity Injection Vulnerability

ALC WebCTRL is a building automation control system from Automated Logic Corporation ALC. An XML external entity injection vulnerability exists in ALC WebCTRL. The vulnerability can be exploited to disclose the contents of a file on the underlying web server operating system via the 'X-Wap-Profil...