libxml2: Multiple vulnerabilities

Background libxml2 is the XML eXtended Markup Language C parser and toolkit initially developed for the Gnome project. Description Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user...

Apache Roller XML-RPC protocol support XML injection vulnerability

Apache Roller is the United States Apache Apache Software Foundation's set of feature-rich multi-user blogging platform. XML-RPC protocol support is one of the XML-RPC transport protocol support component. A security vulnerability exists in the XML-RPC protocol support in Apache Roller versions...

iText PDF Library 7.0.2 / 5.5.11 / 2.0.8 XXE Injection Vulnerability

Exploit for java platform in category remote exploits Product: iText PDF Library Vendor: iText Group CVE ID: CVE-2017-9096 Subject: XML External Entity Attack XXE Risk: Medium Effect: Remotely exploitable Author: Benjamin Bruppacher Date: 2017-11-06 Introduction: ------------- iText is a software...

MediaWiki XXE Vulnerability - Windows

The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service DoS, or possibly have other impact via an XML external entity XXE attack. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be...

CVE-2017-9096

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity XXE attacks via a crafted PDF...

EUVD-2022-3126

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity XXE attacks via a crafted PDF...

Apache ActiveMQ < 5.10.1 Multiple Security Vulnerabilities - Linux

Apache ActiveMQ is prone to multiple security vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:activemq";...

iText XML External Entity Vulnerability

iText is a software development kit that allows users to integrate PDF functionality into their application, process or product. An XML external entity injection vulnerability exists in iText prior to 5.5.12 and version 7.x prior to 7.0.3. The vulnerability arises because the XML parser in iText...

Oracle PeopleSoft Enterprise PeopleTools < 8.55 - Remote Code Execution Via Blind XML External En

Exploit for java platform in category web applications !/usr/bin/python3 Oracle PeopleSoft SYSTEM RCE https://www.ambionics.io/blog/oracle-peoplesoft-xxe-to-rce cf 2017-05-17 import requests import urllib.parse import re import string import random import sys from...

XML External Entity (XXE) Processing

These PHP packages are vulnerable to XML external entity XXE processing attacks. The attacks exist because they do not properly scan the validity of XML string...

XML External Entity (XXE) Processing

zendframework/zendRest and zendframework/zendservice-amazon are vulnerable to XML external entity XXE processing attacks. The attacks exist because they do not properly scan the validity of the XML result data string in the construct function of Result.php and the validity of the http response bo...

XML External Entity (XXE) Processing

zendframework/zend-json is susceptible to XML external entity XXE processing attacks. The attacks can be triggered because when loading an XML formatted string into a Simple XML Element object. The fromXml function in Json.php does not validate the XML formatted string properly...

XML External Entity (XXE) Processing

zendframework is vulnerable to XML external entity XXE processing attacks. The attacks exist because it fails to scan the validity of XML input when loading XML...

Ladon Framework For Python 0.9.40 XXE Injection Vulnerability

Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service with exponentially growing memory payloads. Versions 0.9.40...

Ladon Framework for Python 0.9.40 - XML External Entity Expansion

Advisory: XML External Entity Expansion in Ladon Webservice Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service...

Ladon Framework For Python 0.9.40 XXE Injection

Advisory: XML External Entity Expansion in Ladon Webservice Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service...

Oracle Java SE Wv8u131 Information Disclosure

!/usr/local/bin/python """ Oracle Java SE Web Start jnlp XML External Entity Processing Information Disclosure Vulnerability Affected: + eg: ./poc.py 'C:/Program Files/Java/jre1.8.0131/README.txt' saturn: mrme$ ./poc.py 'C:/Program Files/Java/jre1.8.0131/README.txt' Oracle Java Web Start JNLP XML...

PT-2020-6701

Name of the Vulnerable Software and Affected Versions FasterXML Jackson Databind affected versions not specified Description A flaw in FasterXML Jackson Databind allows vulnerability to XML external entity XXE attacks due to improper entity expansion security. The highest threat from this issue i...

Oracle Java SE - Web Start jnlp XML External Entity Processing Information Disclosure Exploit

Exploit for java platform in category web applications !/usr/local/bin/python """ Oracle Java SE Web Start jnlp XML External Entity Processing Information Disclosure Vulnerability Affected: + eg: ./poc.py 'C:/Program Files/Java/jre1.8.0131/README.txt' saturn: mrme$ ./poc.py 'C:/Program...

Apache OpenNLP XXE Vulnerability

Apache OpenNLP is the United States Apache Apache Software Foundation developed a toolkit based on machine learning for processing natural language text. A security vulnerability exists in Apache OpenNLP. An attacker could exploit this vulnerability to conduct XML external entity injection attack...