MGASA-2016-0175 Updated jackson-dataformat-xml packages fix CVE-2016-3720

Updated jackson-dataformat-xml packages fix security vulnerability: It was reported that XmlMapper in jackson-dataformat-xml is vulnerable to XXE attack "Improper Restriction of XML External Entity Reference" CVE-2016-3720...

Debian Security Advisory DSA 3575-1 (libxstream-java - security update)

It was discovered that XStream, a Java library to serialize objects to XML and back again, was susceptible to XML External Entity attacks. OpenVAS Vulnerability Test $Id: deb3575.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3575-1 using nvtgen 1.0 Script version: 1.0...

openSUSE Security Update : php5 (openSUSE-2016-576)

This update for php5 fixes the following issues : - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mbstrcut bsc977003 - CVE-2016-3074: Signedness vulnerability in bundled libgd ma...

DSA-3575-1 libxstream-java - security update

Bulletin has no description...

PT-2016-5649 · Xstream +1 · Xstream +1

Name of the Vulnerable Software and Affected Versions: XStream versions prior to 1.4.9 Description: The issue concerns multiple XML external entity XXE vulnerabilities in various drivers of XStream. These vulnerabilities allow remote attackers to read arbitrary files via a crafted XML document. N...

CVE-2016-1343

The XML parser in Cisco Information Server CIS 6.2 allows remote attackers to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCuy39059...

CVE-2016-1343

The XML parser in Cisco Information Server CIS 6.2 allows remote attackers to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCuy39059...

Xxe

The XML parser in Cisco Information Server CIS 6.2 allows remote attackers to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCuy39059...

CVE-2016-1343

The XML parser in Cisco Information Server CIS 6.2 allows remote attackers to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCuy39059...

CVE-2016-1343

Cisco Information Server (CIS) 6.2 is affected by an XML External Entity (XXE) vulnerability in the XML parser, where external entity declarations combined with an entity reference can allow remote attackers to read arbitrary files or cause a denial of service (CPU/memory). Exploitation details a...

Tenable Nessus 6.0.x < 6.6 Multiple Vulnerabilities

According to its self-reported version, the Tenable Nessus application running on the remote host is 6.x prior to 6.6. It is, therefore, affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input. An authenticated,...

PHP 'libxml_disable_entity_loader()' Denial of Service Vulnerability

PHP is an open source general-purpose computer scripting language. PHP threads can share the 'libxmldisableentityloader' setting, allowing remote attackers to exploit the vulnerability by submitting XML external entity injections and entity extensions to crash the application...

USN-2952-1 php5 vulnerabilities

It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this issue to create arbitrary directories. CVE-2014-9767 It was discovered that the PHP Soap client incorrectly validated data types. A remote...

USN-2952-1: PHP vulnerabilities

It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this issue to create arbitrary directories. CVE-2014-9767 It was discovered that the PHP Soap client incorrectly validated data types. A remote...

SAP NetWeaver AS JAVA UDDI Component XML External Entity Reference Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications.SAP NetWeaver AS Java is an application server that runs in NetWeaver and is based on the Java programming language. An XML external entity reference...

CVE-2016-4014

XML external entity XXE vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service system hang via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389...

CVE-2016-4014

XML external entity XXE vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service system hang via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389...

Xxe

XML external entity XXE vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service system hang via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389...

SAP NetWeaver Java AS XXE Vulnerability

SAP NetWeaver is SAP's integrated technology platform and the technology foundation for all SAP applications since SAP Business Suite. A xxe security vulnerability exists in the SAP NetWeaver Java AS version 7.4 Configuration Wizard, which can be exploited by remote attackers to cause a denial of...

CVE-2016-3974

XML external entity XXE vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to tcmonitoringwebserviceweb/ServerNodesWSService, aka SA...