SUSE-SU-2017:2299-1 Security update for expat

This update for expat fixes the following issues: - CVE-2016-9063: Possible integer overflow to fix inside XMLParse leading to unexpected behaviour bsc1047240 - CVE-2017-9233: External Entity Vulnerability could lead to denial of service bsc1047236...

Siemens OPC UA Protocol Stack Discovery Service (Update E)

CVSS v3 8.2 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: Industrial products using the Discovery Service of the OPC UA protocol stack by the OPC foundation Vulnerability: Improper Restriction of XML External Entity Reference AFFECTED PRODUCTS Siemens...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

xmlsec XML External Entity Injection Vulnerability

xmlsec is a C-based library for implementing XML security standards. An XML external entity injection vulnerability exists in xmlsec 1.2.23 and earlier versions. An attacker could exploit this vulnerability to obtain information or cause a denial of service with the help of a specially crafted...

MGASA-2017-0305 Updated xmlsec1 packages fix security vulnerability

It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion XXE along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service CVE-2017-1000061...

XML External Entity (XXE) Injection Through Insecure Defaults

dom4j is vulnerable to XML External Entity Injection. The library by default uses the SAXReader to parse documents without using the setFeature function in it to disable doctype and entities, allowing a malicious user to pass a document to execute an XML Injection attack...

xmlsec1: xmlsec vulnerable to external entity expansion

It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion XXE along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service...

IBM Sterling B2B Integrator XML Injection Vulnerability

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An XML external entity injection vulnerability exists in IBM...

CVE-2017-1192

IBM Sterling B2B Integrator 5.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 123663...

CVE-2017-1192

IBM Sterling B2B Integrator 5.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 123663...

Xxe

IBM Sterling B2B Integrator 5.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 123663...

CVE-2017-1192

IBM Sterling B2B Integrator 5.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 123663...

Adobe Digital Editions Multiple Vulnerabilities (Aug 2017) - Mac OS X

Adobe Digital Edition is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:digitaleditions...

Adobe Digital Editions Multiple Vulnerabilities (Aug 2017) - Windows

Adobe Digital Edition is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:digitaleditions...

Apache Wink XML External Entity Vulnerability

Apache Wink is a U.S. Apache Apache Software Foundation for building RESTful Web services framework , which consists of a server module and the client module for the development of RESTful Web services . An XML external entity injection vulnerability exists in Apache Wink 1.1.1 and earlier...

Adobe Digital Editions < 4.5.6 Multiple Vulnerabilities (APSB17-27) (macOS)

The version of Adobe Digital Editions installed on the remote macOS or Mac OS X host is prior to 4.5.6. It is, therefore, affected by multiple vulnerabilities : - An XML external entity XXE parsing flaw exists that can lead to information disclosure. CVE-2017-11272 - An unspecified buffer overflo...

Microsoft Windows Performance Monitor XXE Injection Information Disclosure (CVE-2017-0170)

An XML external entity XXE injection vulnerability exists in Windows Performance Monitor component of Microsoft Windows. The vulnerability is due to a failure to properly handle external entity references in XML files...

Symantec Management Console Multiple XSS and XXE Vulnerabilities (SYM17-005)

The version of Symantec Manager Console running on the remote host is earlier then ITM 8.1 RU1, ITMS 8.0POSTHF6 or ITMS 7.6POSTHF7 and is therefore affected by multiple cross-site scripting XSS and XML External Entity XXE processing vulnerabilities. C Tenable Network Security, Inc...

IBM InfoSphere Information Server XML External Entity Injection Vulnerability

IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. An XML external entity injection vulnerability exists in IBM InfoSphere Information Server versions 9.1,...