Oracle WebLogic Server Multiple Vulnerabilities (January 2019 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - XML external entity XXE vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read...

XML External Entity Injection (XXE)

Spring Integration is vulnerable to XML external entity injection XXE. The library does not filter malicious XML data input due to failing to disable the Document Type Definition External Entities by default...

XML External Entity Injection (XXE)

spring-ws is vulnerable to XML external entity injection XXE. The external document type definition external entities is not disabled by default and allows a remote attacker to perform XXE attacks via malicious XML data input...

Unsafe Deserialization

shopware/shopware is vulnerable to XML external entity attacks via unsafe deserialization. The sort parameter in the function loadPreviewAction in the ShopwareControllersBackendProductStream controller is not validated before PHP object instantiation is performed, which would allow an attacker to...

XML External Entity Injection (XXE)

Spring Batch Core is vulnerable to XML external entity injection XXE. The vulnerability exists because it fails to disable Document Type Definition External Entities by default, allowing an attacker to perform XXE attacks using malicious XML data input...

BlogEngine XML External Entity Injection Vulnerability

BlogEngine is an open source ASP.NET blog system . The system supports Ajax comments , custom themes and so on. An XML external entity injection vulnerability exists in BlogEngine version 3.3. Currently there is no information about this vulnerability , please stay tuned to CNNVD or vendor...

Remote Code Execution (RCE)

lucene-queryparser is vulnerable to remote code execution. This is possible through the use of an XML external entity expansion XXE attack and the Config API with add-listener command...

XML External Entity (XXE)

PySAML2 is vulnerable to XML external entity attacks XXE. The vulnerability allows remote malicious users to read arbitrary files using a SAMPL XML request or response as the injection vector for the XXE attack...

XML External Entity (XXE) Through An XSLT Extension

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity XXE attacks via a crafted XSLT extension in a 1 or 2 JSTL XML tag...

XML External Entity (XXE)

spacewalk-java is vulnerable to XML External Entity XXE attacks. The vulnerability exists as the RPC interface in Spacewalk and Red Hat Network RHN Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors...

XML External Entity (XXE)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain Tomcat internals information by leveraging the presence of an untrusted web application with a context.xml, web.xml, .jspx, .tagx, or .tld XML document containing an external entity declaration in...

XML External Entity (XXE)

postgresql is vulnerable to XML External Entity XXE attacks. The vulnerability exists as the libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote...

XML External Entity (XXE)

picketlink-federation is vulnerable to XML External Entity XXE attacks. The vulnerability exists as the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references...

XML External Entity (XXE)

librsvg2 is vulnerable to XML External Entity XXE attacks. The vulnerability exists as GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entit...

XML External Entity (XXE) To Read Files

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...

Security Bulletin: IBM Security Identity Manager is affected by multiple vulnerabilities (CVE-2018-1956, CVE-2018-1969, CVE-2018-1967, CVE-2018-2019)

Summary IBM Security Identity Manager ISIM has addressed the following vulnerabilities that can allow attackers to compromise user accounts via weak passwords, uploading or transferring dangerous files types, cross-site scripting, or information disclosure and denial of service attacks...

PT-2019-8297 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.3.4 Description: The issue is related to a PHP Object Instantiation problem. It can be triggered via the sort parameter to the loadPreviewAction method of the Shopware Controllers Backend ProductStream controller...

The vulnerability of Microsoft SQL Server Management Studio, related to errors in restricting XML references to external objects (XXE), allows attackers to disclose sensitive information.

The vulnerability of Microsoft SQL Server Management Studio is related to errors in restricting XML references to external objects XXE. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information using a specially crafted file...

The vulnerability of the Microsoft SQL Server Management Studio database management system, related to errors in XML references to external objects (XXE), allows for the disclosure of sensitive information.

The vulnerability of the Microsoft SQL Server Management Studio database management system is related to errors in XML references to external objects XXE. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information using a specially crafted file...

XML External Entity Injection (XXE)

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...