CVE-2016-3027

IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources...

CVE-2016-6059

IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources...

CVE-2016-3027

CVE-2016-3027 affects IBM Security Access Manager products. The IBM Security Access Manager for Web (8.0 appliances, all firmware), Security Access Manager for Mobile (8.0), and Security Access Manager (9.0) are vulnerable to a denial of service due to an XML External Entity (XXE) issue when proc...

CVE-2015-7743

XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file...

CVE-2015-7743

CVE-2015-7743 concerns Paessler PRTG Network Monitor. The vulnerability is an XML External Entity (XXE) expansion flaw in which authenticated users who can create a new HTTP XML/REST Value sensor can read arbitrary files on the PRTG host by supplying crafted XML. Affected versions: before 16.2.23...

SAP NetWeaver XML External Entity Information Disclosure Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in SAP NetWeaver version 7.5. An attacker could exploit this...

pdfbox: XML External Entity vulnerability

It was found that the parsing of XMP and other XML formats in PDF by Apache PDFBox would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks...

SUSE-SU-2017:0164-1 Security update for libxml2

This update for libxml2 fixes the following issues: CVE-2016-9318: libxml2 did not offer a flag directly indicating that the current document may be read but other files may not be opened, which made it easier for remote attackers to conduct XML External Entity XXE attacks via a crafted document...

Juniper Junos XML Sensitive Information Disclosure Vulnerability

Juniper Junos is a network operating system dedicated to the company's hardware systems. An XML external entity injection exists in the Juniper Junos Space WEB management interface, allowing remote attackers to exploit the vulnerability by submitting a special request to obtain sensitive file...

python-pysaml2 XML External Entity Injection Vulnerability

python-pysaml2 is an implementation of SAML2 written in python. An XML external entity injection vulnerability exists in python-pysaml2. An attacker could use this vulnerability to gain access to sensitive information or cause a denial of service...

Debian DSA-3759-1 : python-pysaml2 - security update

Matias P. Brutti discovered that python-pysaml2, a Python implementation of the Security Assertion Markup Language 2.0, did not correctly sanitize the XML messages it handled. This allowed a remote attacker to perform XML External Entity attacks, leading to a wide range of exploits. %NASLMINLEVEL...

[SECURITY] [DSA 3759-1] python-pysaml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3759-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 12, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3759-1] python-pysaml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3759-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 12, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3759-1 (python-pysaml2 - security update)

Matias P. Brutti discovered that python-pysaml2, a Python implementation of the Security Assertion Markup Language 2.0, did not correctly sanitize the XML messages it handled. This allowed a remote attacker to perform XML External Entity attacks, leading to a wide range of exploits. OpenVAS...

XML External Entity (XXE) Injection

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to XML External Entity XXE Injection when opting into the DTDLOAD option and opting out of the NONET option. Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt...

XML External Entity (XXE) Injection

Overview nokogiri is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors. Affected versions of this Gem are vulnerable to XML External Entity XXE attacks. Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, which are librari...

XML External Entity (XXE)

hbase-rest is vulnerable to XML External Entity XXE injection. This is possible because it does not block external entities from being parsed...

ForgeRock OpenAM - Access Management XML External Entity Injection Vulnerability

ForgeRock OpenAM - Access Management is the United States ForgeRock company's set of open source single sign-on framework SSO, which provides a core identity services Core Server to achieve a transparent single sign-on in a network architecture such as centralized, distributed single sign-on. An...

IBM License Metric Tool and BigFix Inventory XML External Entity Injection Vulnerability

The IBM License Metric Tool and BigFix Inventory are both products of IBM Corporation of America. The former is a set of free tools that help IBM Passport Advantage Software Upgrade and Support Services customers determine their Processor Value Unit PVU licensing needs, and the latter is a soluti...

Xxe

XML External Entity XXE Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter...