CVE-2023-42445 Possible local file exfiltration by XML External entity injection

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack OOB-XXE, just parsing XML can lead to exfiltration of local tex...

CVE-2023-42445 Possible local file exfiltration by XML External entity injection

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack OOB-XXE, just parsing XML can lead to exfiltration of local tex...

Exploit for Improper Restriction of XML External Entity Reference in Dogtagpki

CVE-2022-2414 CVE-2022-24...

Exploit for Improper Restriction of XML External Entity Reference in Dogtagpki

CVE-2022-2414 CVE-2022-24...

apache-ivy: XML External Entity vulnerability

Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy...

Security Bulletin: OpenSource Apache Taglibs Vulnerability affects IBM Jazz Reporting Service (CVE-2015-0254)

Summary Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID:CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to...

Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing is vulnerable to a remote attack due to Apache Jena Core

Summary BM Engineering Lifecycle Optimization - Publishing is vulnerable to a remote attack due to Apache Jena Core Vulnerability Details CVEID:CVE-2021-39239 DESCRIPTION: Apache Jena could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity...

Security Bulletin: IBM Jazz Reporting Service is vulnerable to XML external entity (XXE) attacks due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0 (CVE-2021-39239)

Summary IBM Jazz Reporting Service is vulnerable to CVE-2021-39239 due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0. Apache Jena is used by IBM Jazz Reporting Service for working with RDF models. The fix disables external entity processing in calls made to the...

(0Day) D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the addDv7Probe function. Due to the improper restriction of XML External Entity X...

PT-2023-6102 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View versions affected versions not specified Description: The issue is related to the addDv7Probe function and involves improper restriction of XML External Entity XXE references. This allows remote attackers to disclose sensitive...

MAL-2023-8280 Malicious code in @badolkhan420/fca-badol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 436ac692985a2fae4a79ec7010810f6a2b4d617ea932fab96f222989b578f74b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-42132

FD Application Apr. 2022 Edition Version 9.01 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker...

Improper restriction of XML external entity references (XXE) in FD Application

Overview FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references XXE CWE-611. Toyama Taku and Sakaki Ryutaro of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...

FD Application Code Issue Vulnerability

FD Application is an application software from FD. A code issue vulnerability exists in FD Application Apr. 2022 Edition 9.01 and prior versions that stems from improperly restricting XML External Entity References XXE, which could allow an attacker to read arbitrary files on the system by...

PT-2023-28280 · Unknown · Application

Name of the Vulnerable Software and Affected Versions: FD Application versions 9.01 and earlier Description: The issue improperly restricts XML external entity references XXE, allowing an attacker to read arbitrary files on the system by processing a specially crafted XML file. Recommendations: F...

Security Bulletin: Multiple vulnerabilities in Apache Camel core affect IBM Application Performance Management products

Summary Apache Camel core is used by IBM Application Performance Management. The vulnerabilities in the product component have been addressed. Vulnerability Details CVEID:CVE-2014-0002 DESCRIPTION: Apache Camel could allow a remote attacker to obtain sensitive information, caused by an error in t...

Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to XML external entity XXE due to Apache Ivy

Summary Apache Ivy may be used by plugins or custom scripts in IBM UrbanCode Deploy UCD. Apache Ivy is vulnerable to a XXE caused by improper handling of XML external entity XXE declarations by the XML parser. CVE-2022-46751 Vulnerability Details CVEID:CVE-2022-46751 DESCRIPTION: Apache Ivy could...

The vulnerability of the IoT device management software Eclipse Leshan, related to incorrect restrictions on XML references to external objects, allows attackers to execute XXE attacks.

The vulnerability of the IoT device management software Eclipse Leshan is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a remote attacker to execute an XXE attack...

CVE-2023-38343

An XXE XML external entity injection vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery...

Ivanti Endpoint Manager Code Issue Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager versions prior to 2022 SU4, which stems from the presence of XML External Entity Injection in the CSEP component, where external entity...