CVE-2019-10466

CVE-2019-10466 is an XXE vulnerability in the Jenkins 360 FireLine Plugin. The issue arises when an attacker with Overall/Read access can cause Jenkins to resolve external entities, enabling extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service. Public re...

PT-2019-11860 · Jenkins · Jenkins 360 Fireline Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins 360 FireLine Plugin affected versions not specified Description: The issue is related to an XML external entities XXE vulnerability, which allows attackers with Overall/Read access to have Jenkins resolve external entities. This can...

Cisco Unified Communications Manager WEB Interface XXE Attack Vulnerability

Cisco Unified Communications Manager is a unified communications solution. An XXE attack vulnerability exists in the Cisco Unified Communications Manager WEB interface, which allows remote attackers to exploit the vulnerability by submitting a specially crafted XML request, which can be used to...

XML External Entities (XXE)

saml-client is vulnerable to XML external entities XXE. The vulnerability exists as DISALLOWDOCTYPEDECLFEATURE was not enabled when creating the DOMParser object...

XML External Entities (XXE)

expat is vulnerable to denial of service. Entities expansions are not properly handled unless using the XMLSetEntityDeclHandler function. This allows remote attackers to crash the process, send HTTP requests on behalf of the server or read arbitrary files via a malicious XML document...

CVE-2019-10337

An XML external entities XXE vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side...

PT-2019-2638 · Jenkins · Jenkins Token Macro Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Token Macro Plugin versions 2.7 and earlier Description: The issue is related to an XML external entities XXE vulnerability. It allows attackers who can control the content of the input file for the "XML" macro to have Jenkins resolve...

CVE-2019-10327

An XML external entities XXE vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for...

CVE-2019-10327

An XML external entities XXE vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for...

The vulnerability of the jackson-databind library, related to an error in restricting XML links to external objects, allows attackers to execute XXE attacks.

The vulnerability of the jackson-databind library is related to an error in restricting XML links to external objects. Exploiting this vulnerability may allow a remote attacker to execute an XXE attack using polymorphic deserialization...

PT-2019-5542

Name of the Vulnerable Software and Affected Versions dom4j versions 1.x and 2.0.x through 2.1.2 dom4j version 2.1.x before 2.1.3 Description The issue is related to the incorrect restriction of XML links to external objects in the dom4j library, which might enable XXE attacks. This could allow a...

XML External Entities (XXE)

jsbml-core is vulnerable to XML External Entities XXE attacks. The vulnerability exists as external entities are not disabled by default in SBML files, allowing an attacker to load and retrieve system files such as /etc/passwd...

Server side request forgery (ssrf)

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it either by direct modification or MITM attacks when using remote rulesets to perform information disclosure, denial of service, or request forgery...

CVE-2019-7722

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it either by direct modification or MITM attacks when using remote rulesets to perform information disclosure, denial of service, or request forgery...

CVE-2019-7722

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it either by direct modification or MITM attacks when using remote rulesets to perform information disclosure, denial of service, or request forgery...

CVE-2019-7722

PMD 5.8.1 and earlier is vulnerable to XML External Entity (XXE) processing in ruleset files parsed during analysis. The underlying issue is the handling of XML external entities, which attackers can exploit by tampering with the ruleset (direct modification or via MITM when remote rulesets are u...

The vulnerability of the web interface of the Cisco Secure Access Control System allows a perpetrator to access confidential information.

The vulnerability of the Cisco Secure Access Control System’s web interface is related to incorrect processing of external XML entities when working with XML files. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

XML External Entity Injection (XXE)

Spring Integration is vulnerable to XML external entity injection XXE. The library does not filter malicious XML data input due to failing to disable the Document Type Definition External Entities by default...

XML External Entity Injection (XXE)

Spring Batch Core is vulnerable to XML external entity injection XXE. The vulnerability exists because it fails to disable Document Type Definition External Entities by default, allowing an attacker to perform XXE attacks using malicious XML data input...

Arbitrary File Access With External Entities

RESTEasy is vulnerable to arbitrary file access. When resteasy.document.expand.entity.references parameter is set to false, it sets external entities to disable. This vulnerability is possible due to an incomplete fix for CVE-2012-0818...