CVE-2022-46754

Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license features for which this admin is not authorized in order to configure user controlled external entities...

Improper access control

Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license features for which this admin is not authorized in order to configure user controlled external entities...

Dell Wyse Management Suite 安全漏洞

Wyse Management Suite is Dell's hybrid cloud security management solution for Wyse thin client devices, designed to simplify IT management processes and enhance device security. An improper access control vulnerability exists in Wyse Management Suite that stems from incorrect access control. An...

CVE-2022-46754

Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license features for which this admin is not authorized in order to configure user controlled external entities...

PT-2023-18714 · Apache · Apache Nifi

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 1.2.0 through 1.19.1 Description: The ExtractCCDAAttributes Processor in Apache NiFi does not restrict XML External Entity references, making flow configurations that include this processor vulnerable to malicious XML...

pki security update

CentOS Errata and Security Advisory CESA-2022:8799 An update for pki-core is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

GHSA-PCC2-W6M8-X5W4 Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin

Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses externa...

PT-2023-10330 · Unknown · E-Contract Dssp

Name of the Vulnerable Software and Affected Versions: e-Contract dssp versions up to 1.3.1 Description: A vulnerability was found in the function checkSignResponse of the file dssp-client/src/main/java/be/e contract/dssp/client/SignResponseVerifier.java. The manipulation leads to xml external...

aXMLRPC 代码问题漏洞

aXMLRPC is a Java library with a lightweight XML-RPC client. A code issue vulnerability exists in aXMLRPC 1.12.0 and earlier versions, which stems from the ResponseParser function in its src/main/java/de/timroes/axmlrpc/ResponseParser.java file that allows an attacker to implement XML external...

K48127735: Apache log4net Vulnerability CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files. CVE-2018-1285 Impact There is no impact; F5 products are not affected...

PT-2022-27946 · Jenkins · Jenkins Plot Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Plot Plugin versions 2.1.11 and earlier Description: The issue allows attackers who can control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of...

pki-core: access to external entities when parsing XML can lead to XXE

A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...

DEBIAN-CVE-2022-44641

In Linaro Automated Validation Architecture LAVA before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service...

Security Bulletin: The IBM® Engineering Lifecycle Management products recommendation for IBM Java XML vulnerability CVE-2022-21299

Summary A flaw in the XML component allows attackers to inflict a denial-of-service and/or access external entities which should be inaccessible. Vulnerability is identified in Java versions 7.0.11.5 and earlier, 7.1.5.5 and earlier, 8.0.7.5 and earlier. Vulnerability Details Refer to the securit...

PT-2022-6426 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions Update 14 and earlier Adobe ColdFusion versions Update 4 and earlier Description: The issue is related to an improper restriction of XML external entity references. This could allow a remote attacker to gain...

Xxe

Improper Restriction of XML External Entity Reference 'XXE' vulnerability in the Policy Engine of Forcepoint Data Loss Prevention DLP, which is also leveraged by Forcepoint One Endpoint F1E, Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20...

Forcepoint Data Loss Prevention 代码问题漏洞

Forcepoint Data Loss Prevention Forcepoint DLP is a data loss prevention software from Forcepoint Corporation, USA. A security vulnerability in the Policy Engine component of Forcepoint Data Loss Prevention stems from an incorrectly configured XML parser in the Policy Engine that fails to support...

Apache Calcite 代码问题漏洞

Apache Calcite is an open source framework from the Apache USA Foundation for building databases and data management systems. A code issue vulnerability exists in Apache Calcite versions prior to 1.32.0 that stems from the SQL operators EXISTSNODE, EXTRACTXML, XMLTRANSFORM, and EXTRACTVALUE not...

CVE-2022-2759

Delta Electronics Delta Robot Automation Studio DRAS versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to emb...

PT-2022-18509 · Delta Electronics · Delta Robot Automation Studio

Name of the Vulnerable Software and Affected Versions: Delta Electronics Delta Robot Automation Studio DRAS versions prior to 1.13.20 Description: The issue arises from improper restrictions in processing XML documents, allowing XML entities with URIs to resolve to documents outside the intended...