PostgreSQL JDBC Driver Code Issue Vulnerability

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A code issue exists in PostgreSQL JDBC Driver PgJDBC versions prior...

PT-2020-6672 · Postgresql +9 · Postgresql Jdbc Driver +9

Name of the Vulnerable Software and Affected Versions: PostgreSQL JDBC Driver aka PgJDBC versions prior to 42.2.13 Description: The issue is related to the incorrect restriction of XML external entities, which can lead to XXE attacks. A remote attacker can exploit this to conduct XXE attacks...

CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files...

DEBIAN-CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files...

CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files...

CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files...

UBUNTU-CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files...

CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files...

CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files...

XML External Entities (XXE)

log4net is vulnerable to XML external entity attacks. External DTDs are enabled by default and allow attackers to perform XXE attacks using malicious XML data and documents...

PT-2020-5531 · Apache +2 · Log4Net +2

Name of the Vulnerable Software and Affected Versions: Apache log4net versions prior to 2.0.10 Description: The issue is related to errors in restricting XML links to external objects XXE in the log4net logging library on the .NET Framework platform. Exploitation of this issue may allow a remote...

Cisco Hosted Collaboration Mediation Fulfillment Code Issue Vulnerability

Cisco Hosted Collaboration Mediation Fulfillment HCM-F is a core management component of a Hosted Collaboration Solution HCS from Cisco. The product provides inventory management, license management, and service provider toolkit. A code issue vulnerability exists in Cisco Hosted Collaboration...

PT-2020-2513 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC Software affected versions not specified Description: The issue is related to improper input validation of HTTP request parameters in the web interface, allowing an unauthenticated, remote attacker to...

DEBIAN-CVE-2020-10683

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

UBUNTU-CVE-2020-10683

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

GHSA-R6J9-8759-G62W Improper Restriction of XML External Entity Reference in jackson-mapper-asl

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar to CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

Apache Olingo XXE Vulnerability

Apache Olingo is a Java library that implements the Open Data Protocol OData. An XXE vulnerability exists in Apache Olingo 4.0.0 - 4.6.0, which is caused by not configuring the XML content-type entity deserializer in Olingo to deny parsing of external entities, and can be exploited to conduct an...

XML External Entities (XXE)

nifi-lookup-services is vulnerable to XML external entities XXE. The vulnerability exists as the XMLFileLookupService allowed trusted users to use a malicious XML file to cause information such as the versions of Java, Jersey, and Apache to be revealed...

XML External Entities (XXE)

jackson-mapper-asl is vulnerable to XML external entity attacks. This vulnerability is similar to CVE-2016-3720 whereby the external DTD is not disabled, allowing an attacker to retrieve system files, or perform requests on behalf of the server using malicious XML documents...

CVE-2019-10466

An XML external entities XXE vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks...