958 matches found
XML External Entity (XXE)
java-xmlbuilder is vulnerable to XML external entities XXE. A malicious user can create external entities when passing the XML to the XML builder or parser...
XStream: enabled processing of external entities
It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks...
XStream: enabled processing of external entities
It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks...
php: libxml_disable_entity_loader setting is shared between threads
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxmldisableentityloader changes in other threads, which allows remote attackers to conduct XML External Entity XXE and XML Entity Expansion XEE attacks via a crafted XML...
SUSE-RU-2016:2413-1 Recommended update for libxml2
This update for libxml2 fixes an issue when processing external entities introduced with the fix for CVE-2014-0191...
jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags
It was found that the Java Standard Tag Library JSTL allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution...
The vulnerability of the Microsoft .NET Framework software platform, which allows a hacker to read arbitrary files
The vulnerability of the Microsoft .NET Framework software platform is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to read arbitrary files using XML data, which contains a declaration of an external object along with a reference to an...
Microsoft .NET Framework Information Disclosure Vulnerability (CNVD-2016-04935)
Microsoft .NET Framework is a comprehensive and consistent programming model developed by Microsoft Corporation USA and a development platform for building Windows, Windows Store, Windows Phone, Windows Server and Microsoft Azure Windows Store, Windows Phone, Windows Server, and Microsoft Azure...
Adobe XMP Toolkit for Java Information Disclosure Vulnerability
Adobe XMP Toolkit for Java American Odobie Adobe company's set of tools used in the Java file creation process embedded in the metadata file . XMPCore is one of the core components . An information disclosure vulnerability exists in XMPCore in Adobe XMP Toolkit for Java 5.1.2 and earlier versions...
PT-2016-3245 · Apache · Apache Xml-Rpc Library
Name of the Vulnerable Software and Affected Versions: Apache XML-RPC library version 3.1.3 Description: The issue is related to an XML external entity XXE vulnerability in the Apache XML-RPC library. This vulnerability allows remote attackers to conduct server-side request forgery SSRF attacks v...
The vulnerability of the Apache Tomcat software allows a malicious attacker to compromise the confidentiality of protected information.
The vulnerability exists in the java/org/apache/catalina/servlets/DefaultServlet.java file of the standard Apache Tomcat servlet. It stems from incorrect restrictions on XSLT style sheets. This allows malicious actors to bypass security restrictions and read arbitrary files, using a specially...
The vulnerability of the Apache Tomcat software allows a malicious attacker to compromise the confidentiality of protected information.
The vulnerability exists in Apache Tomcat due to an improper restriction on the loader class that has access to the XML processor used in XSLT style sheets. This allows malicious actors to read arbitrary files using a specially crafted application that declares external XML entities and contains...
jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags
It was found that the Java Standard Tag Library JSTL allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution...
libxml2: Inappropriate fetch of entities content
XML external entity XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service resource consumption via unspecified vectors...
IBM QRadar SIEM Sensitive Information Access Vulnerability
IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A sensitive...
IBM Rational Team Concert Denial of Service Vulnerability
IBM Rational Team Concert RTC is a software lifecycle management solution based on the Jazz platform and supports decentralized teams to collaborate in real time. A security vulnerability exists in IBM Rational Team Concert's handling of external entities containing malicious XML, which could be...
Apache Apex: source code security analysis report
Several vulnerabilities were discovered in The Apache Software Foundation 'Apache Apex' software: Using XSL Transformation to Execute Any Code Missing Verification of Executable Files' Digital Signature when Executing them from Untrusted Sources HttpOnly Cookies Incorrect User Input Filtration wh...
Cisco Information Server XML Parser Denial of Service Vulnerability
Cisco Information Server is a Java-based information server that is the foundation of the Cisco Data Virtualization Suite. The default configuration of Cisco Information Server's XML parser fails to properly process XML external entities when parsing XML files, allowing remote attackers to perfor...
XStream XML External Entity Vulnerability
XStream is a lightweight , easy to use open source Java class library developed by the XStream team , it is mainly used to serialize objects into XML JSON or deserialize objects. An XML external entity vulnerability exists in XStream version 1.4.9, which stems from the parser in the program...
jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags
It was found that the Java Standard Tag Library JSTL allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution...