7496 matches found
CVE-2022-31261
An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker ca...
CVE-2022-29801
A vulnerability has been identified in Teamcenter V12.4 All versions V12.4.0.13, Teamcenter V13.0 All versions V13.0.0.9. The application contains a XML External Entity Injection XXE vulnerability. This could allow an attacker to view files on the application server filesystem...
PT-2022-2854
Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Cisco TelePresence Video Communication Server affected versions not specified Description The issue is related to improper restriction of XML external entities in the software of Cisco...
XML External Entity (XXE) Injection
Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the SAX parse. An attacker can access sensitive information by submitting XML input referencing external entities. Details XXE Injection is a type of attack against an application that parses XML...
GHSA-W736-QV86-VQ94 TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism
The jumpUrl aka access tracking implementation in tslib/class.tslibfe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified...
TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism
The jumpUrl aka access tracking implementation in tslib/class.tslibfe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified...
OpenStack Cinder file disclosure in image convert
OpenStack Cinder before 2014.1.5 icehouse, 2014.2.x before 2014.2.4 juno, and 2015.1.x before 2015.1.1 kilo allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command...
GHSA-9HCJ-H2QC-689P OpenStack Cinder file disclosure in image convert
OpenStack Cinder before 2014.1.5 icehouse, 2014.2.x before 2014.2.4 juno, and 2015.1.x before 2015.1.1 kilo allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command...
XML External Entity (XXE) Injection
Overview UmbracoCms.Core is an ASP.NET CMS. Affected versions of this package are vulnerable to XML External Entity XXE Injection via importDocumenttype.aspx.cs. Exploiting this vulnerability allows the attacker to obtain sensitive information by reading files on the server or sending TCP request...
GHSA-9284-J4C9-779Q Improper Input Validation in Apache Jackrabbit
XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...
GHSA-WP2F-HRG2-3R5M Improper Restriction of XML External Entity Reference in Apache uimaj
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion XXE capability of various XML parsers. UIMA as part of its...
cn.zhangsw:mysql2mybatis-generator-ui (1.0-release), com.booking.validator:connectors (>=0.0.1, <=0.0.3) +45 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (2.1.2)
org.codehaus.plexus:plexus-archiver MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - cn.zhangsw:mysql2mybatis-generator-ui 1.0-release - com.booking.validator:connectors...
Improper Restriction of XML External Entity Reference in Apache Batik
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a ful...
Improper Restriction of XML External Entity Reference in Apache FOP
In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full...
CVE-2022-29302
SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/SolarFtp.php...
CVE-2022-29302
SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/SolarFtp.php...
CVE-2022-29302
SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/SolarFtp.php...
Design/Logic Flaw
SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/SolarFtp.php...
CVE-2022-29302
CVE-2022-29302 affects SolarView Compact ver.6.00. The vulnerability is a local file disclosure via the hidden page at /html/Solar_Ftp.php, allowing a remote attacker to read and/or alter arbitrary files on the web server (local file disclosure). The related documents confirm this vulnerability a...
