Camel: XXE via XPath expression evaluation

It was found that Apache Camel performed XML External Entity XXE expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and...

Camel: XXE in via SAXSource expansion

It was found that Apache Camel's XML converter performed XML External Entity XXE expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

batik: XML External Entity (XXE) injection in SVG parsing

It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

batik: XML External Entity (XXE) injection in SVG parsing

It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

Critical: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.2.0 update

Red Hat JBoss BPM Suite 6.2.0, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores...

XML External Entity (XXE) Vulnerability in Hitachi Command Suite

Overview XML External Entity XXE Vulnerability exists in Hitachi Command Suite. Impact Malicious attacker might exploit this vulnerability to disclose arbitrary files. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate action...

CloudBees Jenkins Information Disclosure Vulnerability (CNVD-2015-07826)

CloudBees Jenkins is the open source continuous integration server. CloudBees Jenkins 1.638, LTS 1.625.2 or earlier, an XML external entity vulnerability exists in the create-job CLI command, which can be used by a remote attacker to read arbitrary files through the constructed job configuration,...

CVE-2015-5319

XML external entity XXE vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job...

CVE-2015-5319

CVE-2015-5319 is an XXE vulnerability in Jenkins’ create-job CLI that allows remote reading of arbitrary files by crafting a job configuration, which is then used by an XML-aware tool (e.g., get-job, update-job). Affected products/versions include Jenkins before 1.638 and LTS before 1.625.2. The ...

SAP Sybase Adaptive Server Enterprise - XML External Entity Information Disclosure

SAP Sybase Adaptive Server Enterprise - XML External Entity Information Disclosure source: https://www.securityfocus.com/bid/63193/info SAP Sybase Adaptive Server Enterprise is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive...

SAP Sybase Adaptive Server Enterprise XML External Entity Information Disclosure Vulnerability

SAP Sybase Adaptive Server Enterprise suffers from an XXE injection vulnerability. source: http://www.securityfocus.com/bid/63193/info SAP Sybase Adaptive Server Enterprise is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive...

Arbitrary file upload and XML External Entity processing

More info at https://www.neos.io/blog/flow-sa-2015-001.html...

SAP NetWeaver 7.4 XXE Injection Vulnerability

SAP NetWeaver version 7.4 suffers from an XML external entity injection vulnerability. Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 16.04.2015 Reported: 16.04.2015 Vendor response: 16.04.2015 Date of...

SAP Mobile Platform 2.3 XXE Injection

Application: SAP Mobile Platform 2.3 Versions Affected: SAP Mobile Platform 2.3, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 25.02.2015 Reported: 25.02.2015 Vendor response: 25.02.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2152227 Author:...

SAP NetWeaver 7.4 XXE Injection

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 16.04.2015 Reported: 16.04.2015 Vendor response: 16.04.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2168485 Author: Roman Bezhan...

VMware product updates address information disclosure issue.

a. vCenter Server, vCloud Director, Horizon View information disclosure issue VMware products that use Flex BlazeDS may be affected by a flaw in the processing of XML External Entity XXE requests. A specially crafted XML request sent to the server could lead to unintended information be disclosed...

SolarWinds Log and Event Manager XML External Entity Injection Vulnerability

SolarWinds Log and Event Manager LEM is vulnerable to an Extensible Markup Language XML external entity injection SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Microsoft .NET Framework Directory Traversal Vulnerability

Microsoft .NET Framework is a popular software development toolkit. A directory traversal vulnerability in Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2,4.6 allows remote attackers to read arbitrary files by combining entity references with external entity declaratio...

Information disclosure

The XML DTD parser in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka ".NET Information Disclosu...

CVE-2015-6096

CVE-2015-6096 affects Microsoft .NET Framework 2.0 SP2 onward to 4.6. The root cause is an XML DTD parser vulnerability that allows an external entity declaration to be processed with an entity reference, enabling an attacker to read local files (XXE information disclosure). The connected advisor...