CVE-2023-28151

An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity XXE injection via a remote DTD in a DOCX file...

CVE-2023-28150

An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity XXE injection via a remote DTD in a DOCX file...

CVE-2023-28151

CVE-2023-28151 affects Independentsoft JSpreadsheet before 1.1.110. The issue is an XML External Entity (XXE) injection via a remote DTD in a DOCX file, arising from the API behavior. Public detail confirms the vulnerable component as JSpreadsheet’s API and the root cause as XXE in DOCX processin...

Independentsoft JODF 代码问题漏洞

Independentsoft JODF is an open document format API for Java and Android from Independentsoft, Germany. A security vulnerability exists in Independentsoft JODF versions prior to 1.1.110, which stems from the API's susceptibility to XML External Entity XXE injection via a remote DTD in a DOCX file...

CVE-2023-28150

An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity XXE injection via a remote DTD in a DOCX file...

MAN-EAM-0003 代码问题漏洞

Güralp Systems MAN-EAM-0003 is a sensor from Güralp Systems. A security vulnerability exists in MAN-EAM-0003 version V3.2.4 that stems from the presence of an XML External Entity Injection XXE vulnerability...

IBM Aspera XML External Entity Injection Vulnerability

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.2 is vulnerable to XML external entity injection, which stems from not setting the correct filter to allow references to external entities whe...

Security Bulletin: IBM Workload Scheduler is vulnerable to XML External Entity Injection (XXE) attack

Summary IBM Workload Scheduler is vulnerable to XML External Entity Injection XXE exploitation while handling uploaded XML configuration files. Vulnerability Details CVEID:CVE-2022-38389 DESCRIPTION: IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injectio...

Security Bulletin: IBM Workload Scheduler is vulnerable to XML External Entity Injection (XXE) attack

Summary IBM Workload Scheduler is vulnerable to XML External Entity Injection XXE exploitation in "Create Job on Broker" page. Vulnerability Details CVEID:CVE-2022-22486 DESCRIPTION: IBM Tivoli Workload Scheduler is vulnerable to an XML External Entity Injection XXE attack when processing XML dat...

XML External Entity (XXE) Injection

libplist.so is vulnerable to XML External Entity XXE Injection. The vulnerability exists due to the plistfromxml function in xplist.c because external references are not restricted which allows an attacker to use a specifically crafted XML file to issue a request to an arbitrary URL or disclose a...

CVE-2023-27874 IBM Aspera Faspex XML external entity injection

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845...

CVE-2023-27874 IBM Aspera Faspex XML external entity injection

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845...

PT-2023-21387 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 4.4.2 Description: The issue is related to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this to execute arbitrary commands. Recommendations: For...

IBM Aspera 代码问题漏洞

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.2 is vulnerable to XML external entity injection, which stems from not setting the correct filter to allow references to external entities whe...

CVE-2023-1288 ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability

An XML External Entity injection XXE vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server...

CVE-2023-1288

CVE-2023-1288 affects Dassault Systèmes ENOVIA Live Collaboration V6R2013xE. The connected sources describe an XML External Entity (XXE) vulnerability that allows an attacker to read local files on the server (remote read; potential RCE not clearly stated in the documents). The root cause is an X...

CVE-2023-1288 ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability

An XML External Entity injection XXE vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server...

XWiki 1.1-milestone-3 < 13.10.11, 14.x < 14.4.7, 14.5.x < 14.10 XXE Vulnerability (GHSA-gx4f-976g-7g6v)

Xwiki is prone to an XML external entity XXE injection vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki...

Security Bulletin: There is a security vulnerability in Apache SOAP used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2022-40705)

Summary There is a security vulnerability in Apache SOAP used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2022-40705 DESCRIPTION: Apache SOAP is vulnerable to an XML external entity injection XXE attack when processing XML data, caused by a...

PYSEC-2023-15

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity XXE injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version...