Lucene search
+L

959 matches found

Positive Technologies
Positive Technologies
•added 2015/04/14 12:00 a.m.•15 views

PT-2015-3363

Name of the Vulnerable Software and Affected Versions libxml2 affected versions not specified Description The issue is related to insufficient restriction of XML links to external objects in the libxml2 library's XML file parser. This can be exploited by a remote attacker using a specially crafte...

10CVSS7.3AI score0.81039EPSS
SaveExploits40References142
Tenable Nessus
Tenable Nessus
•added 2015/04/13 12:00 a.m.•33 views

Mandriva Linux Security Advisory : batik (MDVSA-2015:203)

Updated batik packages fix security vulnerability : Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary...

6.4CVSS8.2AI score0.16564EPSS
SaveExploits1References2
Mageia
Mageia
•added 2015/04/09 10:44 p.m.•63 views

Updated batik packages fix security vulnerabilities

Updated batik packages fix security vulnerability: Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary fil...

6.4CVSS8.8AI score0.16564EPSS
SaveExploits1References3
OSV
OSV
•added 2015/04/09 10:44 p.m.•15 views

MGASA-2015-0138 Updated batik packages fix security vulnerabilities

Updated batik packages fix security vulnerability: Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary fil...

6.4CVSS6.6AI score0.16564EPSS
SaveExploits1References4
OSV
OSV
•added 2015/03/30 5:25 p.m.•9 views

USN-2551-1 jakarta-taglibs-standard vulnerability

David Jorm discovered that the Apache Standard Taglibs incorrectly handled external XML entities. A remote attacker could possibly use this issue to execute arbitrary code or perform other external XML entity attacks...

7.5CVSS7.1AI score0.1326EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
•added 2015/03/30 6:17 a.m.•11 views

libxml2: external parameter entity loaded when entity substitution is disabled

It was discovered that libxml2 loaded external parameter entities even when entity substitution was disabled. A remote attacker able to provide a specially crafted XML file to an application linked against libxml2 could use this flaw to conduct XML External Entity XXE attacks, possibly resulting ...

4.3CVSS6.8AI score0.08137EPSS
SaveExploits1References4
Oracle linux
Oracle linux
•added 2015/03/30 12:00 a.m.•60 views

libxml2 security update

2.9.1-5.0.1.el71.2 - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball 2.9.1-5.2 - Fix missing entities after CVE-2014-3660 fix - CVE-2014-0191 Do not fetch external parameter entities rhbz1195649 - Fix regressions introduced by CVE-2014-0191 patch...

5CVSS1.4AI score0.08137EPSS
SaveExploits2
OSV
OSV
•added 2015/03/27 12:00 a.m.•21 views

DLA-182-1 batik - security update

Bulletin has no description...

6.4CVSS6.3AI score0.16564EPSS
SaveExploits1
Tenable Nessus
Tenable Nessus
•added 2015/03/26 12:00 a.m.•32 views

Ubuntu 14.04 LTS : Batik vulnerability (USN-2548-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2548-1 advisory. Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a...

6.4CVSS8.3AI score0.16564EPSS
SaveExploits1References2
OSV
OSV
•added 2015/03/25 12:38 p.m.•11 views

USN-2548-1 batik vulnerability

Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary files or cause resource consumption...

6.4CVSS7.1AI score0.16564EPSS
SaveExploits1References2
RedHat Linux
RedHat Linux
•added 2015/03/24 9:05 p.m.•11 views

Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs

It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities XXEs in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive informati...

4.3CVSS6.5AI score0.06905EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2015/03/24 9:05 p.m.•9 views

RESTEasy: XXE via parameter entities

It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible...

7.5CVSS7.4AI score0.04572EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2015/03/11 4:51 p.m.•11 views

Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs

It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities XXEs in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive informati...

4.3CVSS6.5AI score0.06905EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2015/03/11 4:51 p.m.•12 views

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

4.3CVSS6.6AI score0.07616EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2015/03/11 4:51 p.m.•11 views

RESTEasy: XXE via parameter entities

It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible...

7.5CVSS7.4AI score0.04572EPSS
SaveExploits0References4
CNVD
CNVD
•added 2015/02/28 12:00 a.m.•13 views

PNMsoft Sequence Kinetics Directory Traversal Vulnerability

PNMsoft Sequence Kinetics is a next-generation business process management suite released by Israel-based PNMsoft that enables rapid establishment of high-availability workflow applications and close human collaboration on change while maintaining lifecycle governance. A directory traversal...

5CVSS6.9AI score0.01263EPSS
SaveExploits0References1
RedHat Linux
RedHat Linux
•added 2015/02/17 10:27 p.m.•7 views

Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs

It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities XXEs in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive informati...

4.3CVSS6.5AI score0.06905EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2015/02/17 10:27 p.m.•11 views

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

4.3CVSS6.6AI score0.07616EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2015/02/17 10:27 p.m.•11 views

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

4.3CVSS6.6AI score0.07616EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2015/02/11 8:36 p.m.•14 views

RESTeasy: External entities expanded by DocumentProvider

It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessibl...

6.4CVSS5.8AI score0.01955EPSS
SaveExploits0References4
Rows per page
Query Builder