Security Bulletin: DataPower GUI vulnerable to XML External Entity Injection attack (CVE-2018-1421)

Summary DataPower GUI is vulnerable to an XML External Entity Injection attack from a low-privileged DataPower account. IBM has addressed the applicable CVE Vulnerability Details CVEID: CVE-2018-1421 DESCRIPTION: IBM DataPower Gateways is vulnerable to a XML External Entity Injection XXE attack...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM PureApplication System

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM PureApplication System. These issues were disclosed as part of the IBM Java SDK updates in April 2017. IBM PureApplication System has addressed the applicable CVEs. These issues were also addressed by IBM...

Security Bulletin: Vulnerability in Apache Standard Taglibs affects Liberty for Java for IBM Bluemix (CVE-2015-0254)

Summary There is an XML External Entity Injection XXE vulnerability in the Apache Standard Taglibs that affects IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Vulnerability in Apache Standard Taglibs affects IBM WebSphere Application Server (CVE-2015-0254)

Summary There is an XML External Entity Injection XXE vulnerability in the Apache Standard Taglibs that affects IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Multiple security vulnerabilities in Business Space affect IBM Business Process Manager and WebSphere Process Server (CVE-2015-7407, CVE-2015-7400, CVE-2015-7454)

Summary Business Space is a user interface framework that is available in WebSphere Process Server and IBM Business Process Manager BPM. In IBM BPM Express Edition and Standard Edition the framework is not used directly by end users, however, it is still available and contributes parts of the...

Security Bulletin: Security vulnerabilities in Apache Tomcat for WebSphere Application Server Community Edition 2.1.1.6 and 3.0.0.4（CVE-2014-0075, CVE-2014-0096 and CVE-2014-0119）

Summary Security vulnerabilities exist in Apache Tomcat May 2014 X-Force Report that is shipped with IBM WebSphere Application Server Community Edition 2.1.1.6 and 3.0.0.4 Vulnerability Details CVE ID: CVE-2014-0075 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by the...

Dell EMC ECOM XML External Entity Injection Vulnerability

Dell EMC is the new name for the business following the completion of Dell's acquisition of EMC. An XML external entity injection vulnerability exists in Dell EMC ECOM. Allows an attacker to gain unauthorized access to files containing sensitive information or could be used to cause a denial of...

CVE-2018-1456

IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 140091...

Xxe

IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 140091...

CVE-2018-1456

IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 140091...

SearchBlox 8.6.7 - XML External Entity Injection Vulnerability

Exploit for java platform in category web applications Exploit Title: SearchBlox 8.6.7 Out-Of-Band XML eXternal Entity OOB-XXE Exploit Author: Ahmet GUREL, Canberk BOLAT Software Link: https://www.searchblox.com/ Version: = SearchBlox Version 8.6.7 Platform: Java Tested on: Windows CVE:...

RSA Authentication Manager 8.2.1.4.0-build1394922 / < 8.3 P1 - XML External Entity Injection / Cr

Exploit for java platform in category web applications SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XXE & XSS vulnerabilities product: RSA Authentication Manager vulnerable version: 8.2.1.4.0-build1394922, 8.3 P1...

RSA Authentication Manager 8.2.1.4.0-build1394922 8.3 P1 - XML External Entity Injection Cross-Site Flashing DOM Cross-Site Scripting

RSA Authentication Manager 8.2.1.4.0-build1394922 8.3 P1 - XML External Entity Injection Cross-Site Flashing DOM Cross-Site Scripting SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XXE & XSS vulnerabilities product: R...

ModbusPal XML External Entity Injection Vulnerability

ModbusPal is a MODBUS simulator written in Java with a replicated MODBUS environment. An XML external entity injection vulnerability exists in ModbusPal version 1.6b. A remote attacker can exploit this vulnerability by sending a specially crafted .xmpp or .xmpa file to the user to obtain the...

ModbusPal 1.6b - XML External Entity Injection

ModbusPal 1.6b - XML External Entity Injection + Exploit Title: ModbusPal XXE Injection + Date: 05-08-2018 + Exploit Author: Trent Gordon + Vendor Homepage: http://modbuspal.sourceforge.net/ + Software Link: https://sourceforge.net/projects/modbuspal/files/latest/download?source=files + Version:...

Eclipse IDE Eclipse XML Parser External Entity Injection Vulnerability

Eclipse IDE is the Eclipse Foundation's set of integrated development environment . Eclipse XML parser is one of the XML parser . A security vulnerability exists in the Eclipse XML parser in Eclipse IDE 2017.2.5 and earlier versions. An attacker can exploit this vulnerability to perform an XML...

IBM Rational ClearCase Multiple Component XML External Entity Injection Vulnerability

IBM Rational ClearCase is a software configuration management solution from IBM in the United States. The solution provides version control, workspace management, parallel development support and build auditing, etc. CCRC WAN Server/CM Server, etc. are components used in it. An XML external entit...

KYOCERA Multi-Set Template Editor 3.4 - Out-Of-Band XML External Entity Injection

KYOCERA Multi-Set Template Editor 3.4 - Out-Of-Band XML External Entity Injection Vendor: KYOCERA Corporation Product https://global.kyocera.com Affected version: 3.4.0906 Summary: KYOCERA Net Admin is Kyocera's unified device management software that uses a web-based platform to give network...

CVE-2018-1421

IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139023...

Xxe

IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139023...