SOL14138 - XML External Entity Injection (XXE) from authenticated source vulnerability CVE-2012-2997

Vulnerability Recommended Actions To eliminate this vulnerability, upgrade to a version that is listed in the Versions known to be not vulnerable column. Acknowledgements F5 would like to acknowledge SEC Consult Vulnerability Lab for bringing this issue to our attention, and for following the...

DEBIAN-CVE-2012-5656

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity XXE injection attack...

CVE-2012-5656

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity XXE injection attack...

CVE-2012-5656

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity XXE injection attack...

PT-2013-01: XML External Entity Injection in GNOME

Positive Research Center experts have detected a local resources access vulnerability files and internal network resources via XML External Entity enabled in GNOME. An attacker is able to give a user a specially crafted file. If he or she views a folder with the file or opens it, librsvg sends...

Debian DSA-2602-1 : zendframework - XML external entity inclusion

Yury Dyachenko discovered that Zend Framework uses the PHP XML parser in an insecure way, allowing attackers to open files and trigger HTTP requests, potentially accessing restricted information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian Security Advisory DSA 2602-1 (zendframework - XML external entity inclusion)

Yury Dyachenko discovered that Zend Framework uses the PHP XML parser in an insecure way, allowing attackers to open files and trigger HTTP requests, potentially accessing restricted information. OpenVAS Vulnerability Test $Id: deb2602.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from...

Potential XML eXternal Entity injection vectors in Zend Framework 1 Zend_Feed component

More info at https://framework.zend.com/security/advisory/ZF2012-05...

CVE-2012-2239

Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity XXE injection attack, as demonstrated by reading config.php...

Xxe

Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity XXE injection attack, as demonstrated by reading config.php...

PT-2012-3898 · Catalyst It · Mahara

Name of the Vulnerable Software and Affected Versions: Mahara versions 1.4.x through 1.4.3 Mahara versions 1.5.x through 1.5.2 Description: The issue allows remote attackers to read arbitrary files or create TCP connections via an XML external entity XXE injection attack. This can be demonstrated...

Xxe

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...

Xxe

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...

CVE-2012-0818

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...

PT-2012-2885 · Red Hat · Resteasy

Name of the Vulnerable Software and Affected Versions: RESTEasy versions prior to 2.3.1 Description: The issue allows remote attackers to read arbitrary files via an external entity reference in a DOM document, specifically through an XML external entity XXE injection attack. Recommendations: For...

PT-2013-36: XML External Entity Injection in Wonderware Win-XML Exporter

Positive Research Center experts have discovered "XML External Entity Injection" vulnerability in Wonderware Win-XML Exporter. If an attacker manages to make a victim open a project that contains specially crafted XML, Wonderware Win-XML Exporter will automatically send the contents of local or...

PT-2014-64: XML External Entity Injection in Yokogawa FAST/TOOLS

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in the Yokogawa FAST/TOOLS application. A local attacker can trick the WebHMI server into sending data to an outside computer. This vulnerability can also increase the load of the WebHMI...

FreeBSD : Zend Framework -- Multiple vulnerabilities via XXE injection (ec34d0c2-1799-11e2-b4ab-000c29033c32)

The Zend Framework team reports : The XmlRpc package of Zend Framework is vulnerable to XML eXternal Entity Injection attacks both server and client. The SimpleXMLElement class SimpleXML PHP extension is used in an insecure way to parse XML data. External entities can be specified by adding a...

Drupal OpenID External Entity Injection

This module abuses an XML External Entity Injection vulnerability on the OpenID module from Drupal. The vulnerability exists in the parsing of a malformed XRDS file coming from a malicious OpenID endpoint. This module has been tested successfully on Drupal 7.15 and 7.2 with the OpenID module...

CVE-2012-4399

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity XXE injection attack...