PT-2015-18: XML External Entity Injection in 1С:Enterprise

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in the 1C: Enterprise application. This vulnerability allows an attacker to access the internal network resources, file system, and cause a denial of service attack. All XML parsers are...

eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection

============================================= - Release date: 29.10.2015 - Discovered by: Dawid Golunski - Severity: High/Critical - eBay Magento ref.: APPSEC-1045 ============================================= I. VULNERABILITY ------------------------- eBay Magento CE = 1.9.2.1 XML eXternal Entit...

SAP Netwaver XML External Entity Injection Vulnerability

SAP Netwaver is a professional standards-based integrated application platform from SAP. The platform provides components such as portals, application servers and business intelligence solutions. An XML external entity injection vulnerability exists in SAP Netwaver versions prior to 7.01. An...

PT-2016-31: XML External Entity Injection in vCenter Server

The specialists of the Positive Research center have detected an XML External Entity Injection in vCenter Server. Vulnerability in the Log Browser, Distributed Switch setup, and Content Library in the vCenter Server allows an authorized user to obtain sensitive information by sending a specially...

PT-2016-32: XML External Entity Injection in vCenter Server and vRealize Automation

The specialists of the Positive Research center have detected an XML External Entity Injection in vCenter Server. Vulnerability in the Single Sign-On implementation in VMware vCenter Server and vRealize Automation allows attackers to cause a denial of service or obtain sensitive information via a...

PT-2016-30: XML External Entity Injection in vSphere Client

The specialists of the Positive Research center have detected an XML External Entity Injection in vSphere Client. Vulnerability in the vSphere Client allows attackers to obtain sensitive information by tricking a user to connect to a malicious vCenter Server or ESXi. How to fix Update your softwa...

SAP NetWeaver JAVA AS UDDI component - XXE vulnerability

Application: SAP AS JAVA Versions Affected: SAP AS JAVA 7.4 Vendor URL: SAP Bugs: XXE Reported: 20.10.2015 Vendor response: 21.10.2015 Date of Public Advisory: 14.04.2016 Reference: SAP Security Note 2254389 Author: Vahagn Vardanyan ERPScan Vulnerability Information Class: denial of service Impac...

SAP NetWeaver 7.01 - XML External Entity Injection

SAP NetWeaver 7.01 - XML External Entity Injection Title: SAP Netwaver - XML External Entity Injection Author: Lukasz Miedzinski GPG: Public key provided in attachment Date: 29/10/2014 CVE: CVE-2015-7241 Affected software : =================== SAP Netwear : XML Content and Actions - Import sectio...

SAP Netweaver XML External Entity Injection

Title: SAP Netwaver - XML External Entity Injection Author: Lukasz Miedzinski GPG: Public key provided in attachment Date: 29/10/2014 CVE: CVE-2015-7241 Affected software : =================== SAP Netwear : XML Content and Actions - Import section. Vulnerabilities : XML External Entity Injection ...

Adobe ColdFusion BlazeDS XXE (APSB15-21) (credentialed check)

The version of Adobe ColdFusion running on the remote Windows host is affected by an XML external entity injection XXE vulnerability in flex-messaging-core.jar due to an incorrect configuration of the XML parser used in the bundled version of BlazeDS. A remote attacker can exploit this, via a...

Zend Framework 2.4.2 / 1.12.13 XXE Injection

============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161 ============================================= I. VULNERABILITY ------------------------- Zend Framework From http://framework.zend.com/about/ website:...

Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection

Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection ============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161 ============================================= I. VULNERABILITY -------------------------...

Camel: XXE in via SAXSource expansion

It was found that Apache Camel's XML converter performed XML External Entity XXE expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

Puppet Enterprise 3.x < 3.8.1 Multiple Vulnerabilities (Logjam)

According to its self-reported version number, the Puppet Enterprise application running on the remote host is 3.x prior to 3.8.1. It is, therefore, affected by the following vulnerabilities : - An XML external entity injection XXE flaw exists in the Apache ActiveMQ component due to a faulty...

RubyGems ruby-saml XML External Entity Injection Vulnerability

RubyGems ruby-saml is a set of SAML Security Assertion Markup Language development toolkits for the Ruby on Rails framework organized by RubyGems. An XML external entity injection vulnerability exists in RubyGems ruby-saml. An attacker could exploit this vulnerability to cause a denial of service...

MediaWiki < 1.19.24 / 1.23.9 / 1.24.2 Multiple Vulnerabilities

According to its version number, the MediaWiki application running on the remote host is affected by the following vulnerabilities : - An input validation error exists related to handling API errors that allows reflected cross-site scripting attacks. CVE-2014-9714, CVE-2015-2941 - An input...

XML External Entity Injection Vulnerability in Multiple IBM Products

IBM Rational Collaborative Lifecycle Management CLM, etc. are products of IBM Corporation in the U.S. IBM Rational CLM, Rational Team Concert RTC and Rational Engineering Lifecycle Manager are collaborative lifecycle management solutions; Rational Quality Manager RQM is a collaborative, Web-based...

Hikvision DS-7108HWI-SH XML External Entity Injection Vulnerability

Hikvision DS-7108HWI-SH is a digital video recorder product from Hikvision. An XML external entity injection vulnerability exists in the Hikvision DS-7108HWI-SH, which allows an attacker to exploit the vulnerability to obtain sensitive information or conduct denial-of-service attacks via special...

DSA-3265-1 zendframework - security update

Bulletin has no description...

Debian Security Advisory DSA 3265-1 (zendframework - security update)

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework. Except for CVE-2015-3154 , all these issues were already fixed in the version initially shipped with Jessie. CVE-2014-2681Lukas Reschke reported a lack of protection against XML External Entity injection attacks in some...