CVE-2018-11796: Improper Restriction of XML External Entity Reference

In Apache Tika 1.19 CVE-2018-11761, we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after...

Philips iSite/IntelliSpace PACS Vulnerabilities (Update A)

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: Philips Equipment: iSite and IntelliSpace PACS Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Code/Source Code...

CVE-2018-17411: Improper Restriction of XML External Entity Reference

An XML External Entity XXE vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20...

CVE-2018-8420: Improper Restriction of XML External Entity Reference

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows...

CVE-2018-16521: Improper Restriction of XML External Entity Reference

An XML External Entity XXE vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0...

CVE-2018-16303: Improper Restriction of XML External Entity Reference

PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service resource consumption via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564...

CVE-2018-10600: Improper Restriction of XML External Entity Reference

SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution in certain situations on specific platforms, and denial of service attacks...

CVE-2018-14065: Improper Restriction of XML External Entity Reference

XMLReader.php in PHPOffice Common before 0.2.9 allows XXE...

CVE-2016-9491: Improper Restriction of XML External Entity Reference

ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page most likely limited to administrator, to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By...

CVE-2018-0765: Improper Restriction of XML External Entity Reference

A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework...

CVE-2017-6323: Improper Restriction of XML External Entity Reference

The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0POSTHF6, and ITMS 7.6POSTHF7 has an issue whereby XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service,...

CVE-2018-2401: Improper Restriction of XML External Entity Reference

SAP Business Process Automation BPA By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity XXE vulnerability...

CVE-2018-6489: Improper Restriction of XML External Entity Reference

XML External Entity XXE vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML External Entity XXE...

CVE-2017-5828: Improper Restriction of XML External Entity Reference

An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found...

CVE-2018-2392: Improper Restriction of XML External Entity Reference

Under certain conditions SAP Internet Graphics Server IGS 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server IGS to become unavailable...

CVE-2018-1307: Improper Restriction of XML External Entity Reference

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use...

CVE-2018-1000012: Improper Restriction of XML External Entity Reference

Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

CVE-2018-1000009: Improper Restriction of XML External Entity Reference

Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

CVE-2017-15639: Improper Restriction of XML External Entity Reference

tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature...

CVE-2014-0030: Improper Restriction of XML External Entity Reference

The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity XXE attacks via unspecified vectors...