The vulnerability of the implementation of the RunExecutableListener class in the Apache Solr search server and the Apache Lucene library for full-text searching allows a perpetrator to execute arbitrary code.

The vulnerability in the implementation of the RunExecutableListener class of the Apache Solr search server and the Apache Lucene library for full-text searching is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor to...

The vulnerability of the Microsoft Visual Studio software development tool lies in the incorrect limitation on XML references to external objects, which allows attackers to read arbitrary files.

The vulnerability of the Microsoft Visual Studio software relates to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to read arbitrary files using a specially created XML file...

CVE-2019-12154

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions...

The vulnerability of the Apache Tika XML parser and content analysis tool allows a hacker to induce a service failure.

The vulnerability of the Apache Tika XML parsing and content analysis engine is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

The vulnerability of the software platform for integrating Spring Integration corporate applications lies in improper restrictions on XML references to external objects. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the software platform for integrating Spring Integration corporate applications is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility o...

The vulnerability of the syntactic analyzer of the Microsoft XML Core Services for Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the syntactic analyzer in Microsoft XML Core Services for Windows operating systems is related to errors in restricting XML references to external objects. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Qualys Cloud Platform 2.37 New Features

This release of the Qualys Cloud Platform version 2.37 includes updates and new features for Security Assessment Questionnaire and Web Application Scanning, highlights as follows. Security Assessment Questionnaire Manager access to all active campaigns – Questionnaire Manager role now has access ...

The vulnerability of SAP Business Process Automation platform relates to errors in restricting XML references to external objects. This allows attackers to carry out attacks by injecting external XML entities into the system.

The vulnerability of the SAP Business Process Automation BPA platform relates to errors in restricting XML references to external objects, which are obtained from unverified sources. Exploiting this vulnerability allows a malicious actor to carry out an attack by injecting external XML entities a...

The vulnerability of the xmlParsePEReference component in the libxml2 library, which is used for working with XML and HTML files, allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the xmlParsePEReference component in the libxml2 XML parsing library is related to insufficient restrictions on XML references to external objects. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service failures through a specially...

Design/Logic Flaw

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

Description of the security update for Excel 2016: November 13, 2018

None None...

The vulnerability of the YWorksLayouter component of the SAP NetWeaver software integration platform allows a perpetrator to access confidential information or cause service failures.

The vulnerability of the YWorksLayouter component of the SAP NetWeaver software integration platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information or cause service...

The vulnerability of the TranslationSupport component of the SAP NetWeaver software integration platform allows a perpetrator to access confidential information or cause service failures.

The vulnerability of the TranslationSupport component in the SAP NetWeaver software integration platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information or cause servic...

The vulnerability of the Apache ActiveMQ software platform lies in the improper limitation of XML references to external objects. This allows attackers to disclose sensitive information, cause service failures, or have other adverse effects.

The vulnerability of the Apache ActiveMQ software platform is related to an improper limitation on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information, cause service failures, or have other adverse effects through special...

The vulnerability of the Document Sciences xPression enterprise automation system arises from incorrect restrictions on XML references to external objects. This allows attackers to gain access to system files, perform SRF attacks, or cause service failures.

The vulnerability of the Document Sciences xPression enterprise automation system arises from an incorrect limitation on XML references to external objects /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. Exploiting this vulnerability could allow a malicious actor to gain access to syst...

The vulnerability of the software for managing Vmware vSphere Client lies in the improper limitation of XML references to external objects, which allows an attacker to access confidential information.

The vulnerability of the software for managing Vmware vSphere Client is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information by convincing users to connect to the malicious...

Vulnerabilities include the browser of the event log, settings of distributed switches, and the content library of the management server for virtual infrastructure VMware vCenter Server, which allows attackers to access confidential information.

The vulnerability of the event log browser, distributed switch configuration settings, and the content library of the VMware vCenter Server management server is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to...

The vulnerability of the XML parser in the SAP NetWeaver software integration platform allows a hacker to read arbitrary files or cause service failures.

The vulnerability of the XML parser in the SAP NetWeaver software integration platform arises from an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files or cause service failures...

IBM WebSphere Application Server Privilege Acquisition Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. Liberty Profile is a dynamic server profile for WAS. A privilege acquisition vulnerability exists in IBM WAS Liberty Profile version 8.5.5, which can be exploited to gain user...

SimpNews version 2.41.03 File Content Disclosure Vulnerability

netVigilance Security Advisory 69 SimpNews version 2.41.03 File Content Disclosure Vulnerability Description: SimpNews is a news system written in PHP. Features: Data stored in MySQL, admin interface, support for multiple languages, support for multiple instances in one database, own header,...