XML External Entities (XXE)

cvrf2csaf is vulnerable to XML External Entity XXE attacks. The vulnerability exists due to improper input validation in the validateinputagainstschema function in the validateinputagainstschema file This allows to view arbitrary file content...

XML External Entities Vulnerability in CVRF-CSAF-Converter

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...

GHSA-M8GQ-83GH-V42V XML External Entities Vulnerability in CVRF-CSAF-Converter

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...

CVE-2022-27193

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...

CVE-2022-27193

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...

Xxe

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...

CVE-2022-27193

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...

CVE-2022-27193

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...

PT-2022-18280

Name of the Vulnerable Software and Affected Versions CVRF-CSAF-Converter versions prior to 1.0.0-rc2 Description The issue allows for the inclusion of arbitrary local file content into the generated output document due to XML External Entities XXE. This can be exploited by an attacker to disclos...

OverIT Geocall 代码问题漏洞

OverIT Geocall is a field service management solution from OverIT Italy. A code issue vulnerability exists in OverIT Geocall prior to version 8.0, which originates from an XXE vulnerability that can be exploited by an authenticated user with the Test Trasformazione XSL feature enabled to read...

Hazelcast 代码问题漏洞

Hazelcast Hazelcast IMDG is a scalable open-source data distribution platform from Hazelcast, Inc. The platform supports a variety of distributed data structures, distributed caching and other features. Hazelcast versions prior to 5.1 of XML has a code problem vulnerability, which stems from not...

Foxit PDF Editor < 11.2.1 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 11.2.1. It is, therefore affected by multiple vulnerabilities: - Acrobat Reader DC version 21.007.20099 and earlier, 20.004.30017 and earlier and...

Mageia: Security Advisory (MGASA-2015-0138)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

How to disable XXE processing?

In my last post I talked about XXE vulnerabilities found on popular open-source projects and more generally how to assess this type of issue. Today, I’ll talk about the different strategies to disable XXE processing. External XXE and internal entities are useful for building concise XML documents...

Server side request forgery (ssrf)

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities...

CVE-2021-41809 SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server.

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities...

M-Files Server 代码问题漏洞

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in M-Files Server products prior to version 22.1.11017.1, which stems from a preview feature that allows querying from the server for certain document types that reference external entities...

CVE-2021-41809

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities...

PT-2022-4676 · Libexpat +2 · Libexpat +2

Name of the Vulnerable Software and Affected Versions: Prosody affected versions not specified Description: The issue is related to the implementation of the WebSocket server module for Jabber/XMPP in Prosody, which is associated with incorrect restriction of XML links to external objects. This c...

MultiNer代码问题漏洞

National Library Of The Netherlands / Research MultiNer is used by National Library Of The Netherlands / Research to merge the output of five different Dutch named entity recognition packages into a single answer. A security vulnerability exists in MultiNer that stems from insufficient security...