10148 matches found
corenlp 代码问题漏洞
Stanford CoreNlp is a set of open source, natural language analysis tools written in Java by the Stanford Nlp Group team. A code issue vulnerability exists in corenlp that stems from the vulnerability of corenlp to improper restrictions on XML external entity references...
PT-2022-13058
Name of the Vulnerable Software and Affected Versions corenlp affected versions not specified Description The issue is related to Improper Restriction of XML External Entity Reference. No information is provided about the estimated number of potentially affected devices or real-world incidents...
GHSA-MH83-JCW5-RJH8 XML External Entity Reference in edu.stanford.nlp:stanford-corenlp
The TransformXML function makes use of SAXParser generated from a SAXParserFactory with no FEATURESECUREPROCESSING set, allowing for XXE attacks...
XML External Entity (XXE)
corenlp is vulnerable to xml external entity attack. The vulnerability exists due to a lack of sanitization of XML input containing a reference to an external entity...
CVE-2021-40722
AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE...
CVE-2021-40722 AEM Forms Improper Restriction of XML External Entity Reference
AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE...
CVE-2022-0198
corenlp is vulnerable to Improper Restriction of XML External Entity Reference...
CVE-2022-0198
corenlp is vulnerable to Improper Restriction of XML External Entity Reference...
Xxe
corenlp is vulnerable to Improper Restriction of XML External Entity Reference...
CVE-2022-0198 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
corenlp is vulnerable to Improper Restriction of XML External Entity Reference...
CVE-2022-0198
The CVE-2022-0198 entry concerns Stanford CoreNLP (stanfordnlp/corenlp) and an XML External Entity (XXE) vulnerability. Affected component: CoreNLP’s XML processing via TransformXML()/XML parsing paths, leading to improper restriction of external entities. Potential impact (per sources): reading ...
CVE-2021-42560
An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks e.g., File Exfiltration, Server Side Request Forgery, Out of Band...
GHSA-Q4XF-3PMQ-3HW8 Improper Restriction of XML External Entity Reference in Apache NiFi
In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...
pikachu
It is an offensive tool for web application security training. The primary CVE ID is not explicitly mentioned, but the tool is designed to simulate various web application vulnerabilities, including but not limited to: Burt Force brute force, XSS cross-site scripting, CSRF cross-site request...
GHSA-RQ96-QHC5-VM4R Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...
Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...
SUSE: Security Advisory (SUSE-SU-2018:2899-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
pikachu
It is an offensive tool for web application security training. The primary CVE ID is not explicitly stated, but the tool includes various web application vulnerabilities such as Burt Force brute force, XSS cross-site scripting, CSRF cross-site request forgery, SQL-Inject SQL injection, RCE remote...
pikachu
It is an offensive tool for web application security training. The primary CVE ID is not explicitly mentioned, but the tool is designed to simulate various web application vulnerabilities, including Burt Force 暴力破解漏洞, XSS 跨站脚本漏洞, CSRF 跨站请求伪造, SQL-Inject SQL注入漏洞, RCE 远程命令/代码执行, Files Inclusion...