10157 matches found
PT-2022-7018 · Microsoft +6 · Net 6.0 +7
Name of the Vulnerable Software and Affected Versions: .NET Core 3.1 versions 3.1.0 through 3.1.27 .NET 6.0 versions 6.0.0 through 6.0.7 Description: An information disclosure issue exists due to incorrect restriction of XML external entity references, potentially allowing a remote attacker to...
GHSA-F83Q-2CP7-QRJG untangle vulnerable to Improper Restriction of XML External Entity Reference
Description untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files. Impact An attacker may...
CVE-2022-1704
Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup...
CVE-2022-1704
Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup...
CVE-2022-1704 Inductive Automation Ignition
Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup...
CVE-2022-1704
CVE-2022-1704 affects Inductive Automation Ignition. The issue arises from parsing XML in the backup/restore functionality without XML security flags, enabling a potential XML External Entity (XXE) attack. Affected products/versions include: Ignition 8.1.x up to before 8.1.8, and Ignition 7.9.x b...
PT-2022-14058 · Inductive Automation · Ignition
Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue arises from an XML external entity reference, where the software fails to use XML security flags when parsing XML in the backup/restore functionality. This oversight may lead to ...
IBM DataPower Gateway XML External Entity Injection Vulnerability (CNVD-2022-56970)
IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B, and cloud workloads. The platform protects, integrates, and optimizes access across channe...
SRC-2022-0022 : VMWare Cloud Foundation NSX-V VsmUsernamePasswordAuthenticationFilter parseUsernamePasswordFromXML XML External Entity Processing Information Disclosure Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to disclose sensitive information on affected installations of VMWare Cloud Foundation NSX-V. Authentication is not required to exploit this vulnerability. The specific flaw exists within the VsmUsernamePasswordAuthenticationFilter...
CVE-2022-31775
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or...
IBM DataPower Gateway 代码问题漏洞
IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B, and cloud workloads. The platform protects, integrates, and optimizes access across channe...
PT-2022-20921 · Ibm · Ibm Datapower Gateway
Name of the Vulnerable Software and Affected Versions: IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.8 IBM DataPower Gateway versions 10.0.2.0 through 10.0.4.0 IBM DataPower Gateway version 10.5.0.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.21 Description: The issue is...
CVE-2022-2414
Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...
Xxe
Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...
Geonetwork 4.2.0 - XML External Entity (XXE)
Exploit Title: Geonetwork 4.2.0 - XML External Entity XXE Date: 2022-July-11 Exploit Author: Amel BOUZIANE-LEBLOND https://twitter.com/amellb Vendor Homepage: https://geonetwork-opensource.org/ Version: Geonetwork 3.10.X through 4.2.0 Tested on: Microsoft Windows Server & Linux Description:...
Dogtag PKI 代码问题漏洞
Dogtag PKI is an enterprise-class, open-source Certificate Authority CA open-sourced by Dogtag. A security vulnerability exists in Dogtag PKI's XML parser that stems from the fact that accessing an external entity while parsing an XML document could lead to an XML External Entity XXE attack. The...
CVE-2022-31471
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files...
Xxe
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files...
CVE-2022-31471
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files...
PT-2022-20749 · Untangle · Untangle
Name of the Vulnerable Software and Affected Versions: untangle versions 1.2.0 and earlier Description: untangle is a python library to convert XML data to python objects. It improperly restricts XML external entity references, allowing a remote unauthenticated attacker to read the contents of...