906 matches found
XML External Entities (XXE) Attacks
apache-nifi is vulnerable to XML External Entities XXE attacks. The library does not properly handle XML template files, allowing a malicious user to inject external entities that can lead to sensitive information being displayed...
PT-2017-5767 · Apache · Apache Roller
Name of the Vulnerable Software and Affected Versions: Apache Roller versions prior to 5.0.3 Description: The issue allows attackers to conduct XML External Entity XXE attacks. XXE attacks occur when an application parses XML input that contains malicious external entities, which can lead to the...
XML External Entities (XXE)
The Play Framework is vulnerable to XML external entities XXE injection. An attacker may use XML external entities to read files from the file system, internal network, or DoS the application...
Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2017-32687)
Adobe ColdFusion is a dynamic Web server product that runs CFML which is a programming language for Web applications. Adobe ColdFusion fails to properly restrict references to XML external entities, allowing remote attackers to exploit vulnerabilities to submit special requests, obtain sensitive...
camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE
It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...
Trend Micro Control Manager XML External Entity Vulnerability
Trend Micro Control Manager is the centralized management console for managing Trend Micro products and services. A security vulnerability in Trend Micro Control Manager's handling of XML external entities allows remote attackers to exploit the vulnerability by submitting specialized XML data,...
USN-3356-1 expat vulnerability
It was discovered that Expat incorrectly handled certain external entities. A remote attacker could possibly use this issue to cause Expat to hang, resulting in a denial of service...
Ubuntu: Security Advisory (USN-3280-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 14.04 LTS : Apache Fop vulnerability (USN-3281-1)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3281-1 advisory. Pierre Ernst discovered that Apache Fop incorrectly handled XML external entities. A remote attacker could possibly use this issue to obtain sensitive files from...
USN-3281-1 fop vulnerability
Pierre Ernst discovered that Apache Fop incorrectly handled XML external entities. A remote attacker could possibly use this issue to obtain sensitive files from the filesystem, or cause a denial of service...
USN-3281-1: Apache Fop vulnerability
Pierre Ernst discovered that Apache Fop incorrectly handled XML external entities. A remote attacker could possibly use this issue to obtain sensitive files from the filesystem, or cause a denial of service...
USN-3280-1 batik vulnerability
Lars Krapf and Pierre Ernst discovered that Apache Batik incorrectly handled XML external entities. A remote attacker could possibly use this issue to obtain sensitive files from the filesystem, or cause a denial of service...
USN-3280-1: Apache Batik vulnerability
Lars Krapf and Pierre Ernst discovered that Apache Batik incorrectly handled XML external entities. A remote attacker could possibly use this issue to obtain sensitive files from the filesystem, or cause a denial of service...
Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references
Overview Several Java implementations of AMF3 are vulnerable to insecure deserialization and XML external entities references. Description Several Java implementations of Action Message Format AMF3 are vulnerable to one or more of the following implementation errors:CWE-502: Deserialization of...
CVE-2017-5643
It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...
Microsoft Active Directory Federation Services Information Disclosure
An information disclosure vulnerability exists when Windows Active Directory Federation Services ADFS honors XML External Entities. An authenticated attacker who successfully exploited this vulnerability would be able to read sensitive information about the target system. To exploit this conditio...
KLA10986 Information disclosure vulnerability in Microsoft Active Directory Federation Services
An improper honoring of XML External Entities was found in Microsoft Active Directory Federation Services ADFS. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a specially designed request. Original advisories...
Grails PDF Plugin XML External Entity Information Disclosure Vulnerability
Grails PDF Plugin XML External Entity Information Disclosure vulnerability. An attacker can exploit the vulnerability to obtain sensitive information, which could lead to further attacks...