XML External Entity (XXE) Injection

Onos Controller is vulnerable to XML external entitiy XXE injection attack. It is possible because the application does not disable Document Type Definition DTD External Entities by default, allowing a malicious user to inject malicious external entities through XML files...

IBM Rhapsody Design Manager XML Injection of External Entities Vulnerability

IBM Rhapsody Design Manager DM is a suite of collaborative design management software from IBM. The software supports the use of centralized system repositories with Web-based access to store, share, search, and manage design models, as well as software to automate design reviews. A security...

IBM WebSphere Cast Iron Security Bulletin: Multiple security vulnerabilities in IBM JRE 6 and IBM JRE 7

Abstract Multiple security vulnerabilities exist in the IBM Java Runtime Environment component of WebSphere Cast Iron in IBM JRE 6.0 SR15 and earlier and IBM JRE 7.0 SR5 and earlier Content VULNERABILITY DETAILS There are multiple security vulnerabilities in the IBM Java Runtime Environment used ...

XML External Entities (XXE)

nifi-standard-processors is vulnerable to XML external entities XXE attacks. The vulnerability exists due to the lack of proper default configuration which disables external entities by default, allowing XXE attacks to occur...

Adobe ColdFusion Insecure XML Parsing Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. An insecure XML parsing vulnerability exists in Adobe ColdFusion. The vulnerability stems from the program's...

XML External Entities (XXE)

gateway-service-admin is vulnerable to XML external entities XXE attacks. The vulnerability exists due to the improper default configuration in XMLInputFactory where external entities were not disabled, allowing them to be specified and disclosed when parsed...

Pivotal Spring Data Commons Arbitrary File Read Vulnerability

Pivotal Spring Data Commons is a project of Pivotal Software, Inc. in the United States to provide data access based on the Spring model. A security vulnerability in Pivotal Spring Data Commons version 1.13 prior to 1.13.12 and version 2.0 prior to 2.0.7 stems from the program's failure to proper...

PT-2018-11275

Name of the Vulnerable Software and Affected Versions Spring Data Commons versions 1.13 prior to 1.13.12 Spring Data Commons versions 2.0 prior to 2.0.7 Description The issue is caused by improper restriction of XML external entity references in the underlying library XMLBeam, which does not...

jenkins -- multiple vulnerabilities

Jenkins developers report: The agent to master security subsystem ensures that the Jenkins master is protected from maliciously configured agents. A path traversal vulnerability allowed agents to escape whitelisted directories to read and write to files they should not be able to access. Black Du...

CVE-2018-1183

In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management...

Windows Remote Assistance Exploit Lets Hackers Steal Sensitive Files

You have always been warned not to share remote access to your computer with untrusted people for any reason—it's a basic cybersecurity advice, and common sense, right? But what if, I say you should not even trust anyone who invites or offer you full remote access to their computers. A critical...

Microsoft Windows Remote Assistance Information Disclosure Vulnerability

Microsoft Windows is the popular computer operating system. Microsoft Windows Remote Assistance does not properly handle XML external entities and is implemented with an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2018-0878

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to how...

Information disclosure

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to how...

CVE-2018-0878

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to how...

CVE-2018-0878

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to how...

Microsoft Windows Multiple Vulnerabilities (KB4088787)

This host is missing a critical security update according to Microsoft KB4088787 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Windows Remote Assistance Information Disclosure Vulnerability

An information disclosure vulnerability exists when Windows Remote Assistance incorrectly processes XML External Entities XXE. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this condition, an attacker would ne...

KB4088879: Windows 8.1 and Windows Server 2012 R2 March 2018 Security Update (Meltdown)(Spectre)

The remote Windows host is missing security update 4088879 or cumulative update 4088876. It is, therefore, affected by multiple vulnerabilities : - An vulnerability exists within microprocessors utilizing speculative execution and indirect branch prediction, which may allow an attacker with local...

Security Updates for Windows Server 2008 (March 2018)

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when Windows Remote Assistance incorrectly processes XML External Entities XXE. An attacker who successfully exploited the vulnerability...