Ubuntu 18.04 LTS : Yaws vulnerabilities (USN-4569-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4569-1 advisory. It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity XXE...

CVE-2020-15232

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

Xxe

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

CVE-2020-15232 XML External Entity attack in mapfish-print

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

CVE-2020-15232

The CVE-2020-15232 issue affects mapfish-print prior to version 3.24, where XML External Entity (XXE) processing is vulnerable via the SDL parser (DTDs are not disabled), enabling an attacker to inject untrusted entities. Public advisories describe remote XXE exploitation, with remediation statin...

CVE-2020-8256

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity XXE vulnerability...

CVE-2020-21524

There is a XML external entity XXE vulnerability in halo v1.1.3, The function of importing other blogs in the background/api/admin/migrations/wordpress needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks...

Xxe

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity XXE vulnerability...

Xxe

There is a XML external entity XXE vulnerability in halo v1.1.3, The function of importing other blogs in the background/api/admin/migrations/wordpress needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks...

CVE-2020-8256

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity XXE vulnerability...

Security Bulletin: Vulnerabilities in WebSphere Application Server affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerabilities have been identified in WebSphere Application Server and the information about their fixes are published in security bulletins. Vulnerability Details CVEID:...

PT-2020-20064 · Pulse · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R8.2 Description: A vulnerability in the Pulse Connect Secure admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML Extern...

Debian DLA-2384-1 : yaws security update

Two issues have been found in yaws, a high performance HTTP 1.1 webserver written in Erlang. CVE-2020-24379 Reject external resource requests in DAV in order to avoid XML External Entity XXE attackes. CVE-2020-24916 Sanitize CGI executable in order to avoid command injection via CGI requests. For...

IBM WebSphere Application Server 7.0.0.x through 7.0.0.45 / 8.0.0.x through 8.0.0.15 / 8.5.x through to 8.5.5.17 / 9.0.x through to 9.0.5.5 XXE (CVE-2020-4643)

The version of WebSphere Application Server installed on the remote host is 7.0.0.x through 7.0.0.45, 8.0.0.x through 8.0.0.15, 8.5.x through 8.5.5.17, or 9.0.x through 9.0.5.5. It is, therefore, affected by a vulnerability as referenced in the 6334311 advisory. Note that Nessus has not tested fo...

CloudBees Jenkins Liquibase Runner Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A security vulnerability exis...

PT-2020-15513 · Jenkins · Jenkins Liquibase Runner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Liquibase Runner Plugin versions 1.4.5 and earlier Description: The issue allows attackers to provide crafted XML files that use external entities for extraction of secrets from the Jenkins controller or server-side request forgery...

Vulnerability fixed in Websphere Application Server

A vulnerability has been fixed in Websphere Application Server. The vulnerability allows a remote malicious person using a so-called XML-External-Entity-Injection attack to obtain obtain system data. IBM has released updates to fix the vulnerability. More information can be found on the page belo...

IBM WebSphere Application Server XML External Entity Injection Vulnerability

IBM WebSphere Application Server WAS is by IBM in accordance with open standards, such as Java EE, XML and Web Services, development and distribution of an application server. An XML external entity injection vulnerability exists in IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0. A remote...

CVE-2020-4643

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information. IBM X-Force ID: 185590...

XML External Entity (XXE)

JabRef version =4.3.1 contains a XML External Entity XXE vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBib file...