CVE-2017-1000061

XML Security Library (xmlsec) 1.2.23 and earlier is vulnerable to XML External Entity Expansion when parsing crafted input, enabling information disclosure or denial of service. The root cause is improper handling of external entities in the library’s XML processing. Affected environments are doc...

Microsoft Windows System Information Console Information Disclosure Vulnerability

Microsoft windows is a popular operating system. Microsoft System Information Console does not properly parse XML inputs that contain references to external entities, allowing an attacker to exploit the vulnerability by submitting a special XML request, obtaining sensitive information, and...

Microsoft Windows Performance Monitor Information Disclosure Vulnerability (KB4025397)

This host is missing an important security update according to Microsoft KB4025397 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows XML External Entity Local Information Disclosure Vulnerability

Microsoft windows is a popular operating system. Microsoft Windows Performance Monitor does not properly parse XML inputs that contain references to external entities, allowing an attacker to exploit the vulnerability by submitting a special XML request to obtain sensitive information and read...

CVE-2017-8557

Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability improperly parses XML input containing a...

Information disclosure

Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability improperly parses XML input containing a...

Windows Performance Monitor Information Disclosure Vulnerability

An information disclosure vulnerability exists in the Windows Performance Monitor Console when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity XXE...

Windows System Information Console Information Disclosure Vulnerability

An information disclosure vulnerability exists in the Microsoft Common Console Document .msc when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity XXE...

KB4025339: Windows 10 Version 1607 and Windows Server 2016 July 2017 Cumulative Update

The remote Windows host is missing security update KB4025339. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the Windows Performance Monitor Console due to improper parsing of XML input that contains a reference to an external entity. ...

Microsoft Windows CVE-2017-0170 XML External Entity Local Information Disclosure Vulnerability

Description Microsoft Windows is prone to a local information-disclosure vulnerability. A local attacker can leverage this issue to disclose sensitive information that may aid in further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Versi...

SUSE SLES11 Security Update : libxml2 (SUSE-SU-2017:1813-1)

This update for libxml2 fixes the following issues: Security issues fixed : - CVE-2017-0663: Fixed a heap buffer overflow in xmlAddID bsc1044337 - CVE-2017-5969: Fixed a NULL pointer deref in xmlDumpElementContent bsc1024989 - CVE-2017-7375: Prevented an unwanted external entity reference...

SUSE-SU-2017:1813-1 Security update for libxml2

This update for libxml2 fixes the following issues: Security issues fixed: CVE-2017-0663: Fixed a heap buffer overflow in xmlAddID bsc1044337 CVE-2017-5969: Fixed a NULL pointer deref in xmlDumpElementContent bsc1024989 CVE-2017-7375: Prevented an unwanted external entity reference bsc1044894...

openSUSE Security Update : libxml2 (openSUSE-2017-793)

This update for libxml2 fixes the following issues : Security issues fixed : - CVE-2017-7376: Increase buffer space for port in HTTP redirect support bsc1044887 - CVE-2017-7375: Prevent unwanted external entity reference bsc1044894 This update was imported from the SUSE:SLE-12-SP2:Update update...

CVE-2017-1254

IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 124634...

CVE-2017-1254

IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 124634...

CVE-2017-1254

IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 124634...

IBM Security Guardium XML External Entity Injection Vulnerability

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes easy UI customization, report management and discovery and a streamlined audit process builder. An XML external entity injection vulnerability exists in IBM...

OSCI Transport Library OSCI-Transport XXE vulnerability

OSCI Transport Library Java is a Java library of mandatory transport protocols for German e-government, and OSCI Transport Library .NET is its .NET version.OSCI-Transport is one of the XML-based transport protocols. An XML external entity injection vulnerability exists in OSCI Transport Library...

Cisco Prime Infrastructure and EPNM DashboardRenderer XML External Entity Injection (CVE-2017-6662)

A directory traversal vulnerability exists in Oracle Fusion Middleware MapViewer. The vulnerability is due to a lack of proper input sanitization on multipart form-data requests in FileUploaderServlet. A remote attacker can exploit this vulnerability by sending a maliciously crafted HTTP request...

Xxe

An XML External Entity XXE issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 Java and OSCI Transport Library 1.6 .NET, exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure...