CVE-2022-35741

Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity XXE injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When...

CVE-2022-35741

The CVE-2022-35741 issue affects Apache CloudStack 4.5.0 and later, specifically the SAML 2.0 authentication Service Provider plugin. The vulnerability is XML External Entity (XXE) injection in the XML-based SAML messages parsed during authentication. Attacker must have the plugin enabled (not en...

Security Bulletin: IBM Partner Engagement Manager is vulnerable to improper restriction of XXE (CVE-2022-22358)

Summary IBM Sterling Partner Engagement Manager has addressed an XXE vulnerability. Vulnerability Details CVEID:CVE-2022-22358 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploi...

CVE-2022-2458

An XML external entity injectionXXE vulnerability was found in Business Central. This flaw allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. T...

Apache CloudStack 代码问题漏洞

Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. An XML external entity injection vulnerability exists in Apache...

PT-2022-3718 · Apache · Apache Cloudstack

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.5.0 and later Description: The issue is related to the SAML 2.0 authentication Service Provider plugin in Apache CloudStack, which is vulnerable to XML external entity XXE injection attacks. This plugin is not...

CVE-2022-22358

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651...

Business-central 代码问题漏洞

Business-central is a software package. A security vulnerability exists in Business-central that stems from the possibility of receiving an XML external entity injection attack...

GHSA-J3H2-8MF8-J5R2 Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2

In versions prior to 3.3.2, Hudson exhibits a flaw in its XML API processing that can allow access to potentially sensitive information on the filesystem of the Hudson master server...

Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2

In versions prior to 3.3.2, Hudson exhibits a flaw in its XML API processing that can allow access to potentially sensitive information on the filesystem of the Hudson master server...

CVE-2022-2131

OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack...

Malicious code in nmgpvbyzeufscxjh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ef3cb78242f21839f9932efac0bec33fa4eb78d39d685bdb5541e2d2a9055c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ohwczbeuslaxvpmd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c959b5a985a72d8c0cd2177512887ec29d8b85ce98adc5e0c9b90d4c2e7fe1e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1747 Malicious code in byxctlvkeqhduiza (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 981d84fff485e2abe8d3ac19a4328cc7ab70e98cc378f1a4966bc3776ce2f539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hldqgyckmuwxjefs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c36bd592f3ed72aefd6e362450c65f36a30e0add033ca8d4843a6b5d7c485ed6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML External Entity (XXE)

org.eclipse.lyo.oslc4j.core:oslc4j-jena-provider is vulnerable to XML external entity attack. Default initialization of createTransformer does not restrict DTD document loading when working with RDF/XML formats, which allows remote attackers to retrieve external DTD documents...

CVE-2022-32458

Digiwin BPM has a XML External Entity Injection XXE vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files...

GHSA-6296-MVGP-27HP XML External Entity Reference in Eclipse Lyo

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved...

mysql-connector-java: unauthorized access to critical

MySQL Connector/J has no security check when external general entities are included in XML sources, consequently, there exists an XML External EntityXXE vulnerability. A successful attack can access critical data and gain full control/access to all MySQL Connectors' accessible data without any...

Security Bulletin: IBM Tivoli Network Manager is vulnerable to XML external entity (XEE) attacks due to FasterXML (CVE-2020-25649)

Summary FasterXML Jackson Databind, used by IBM Tioli Network Manager,contains a flaw where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity. The library has been...