CVE-2019-9843

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

OPENSUSE-SU-2019:1619-1 Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issues: - disable indirect reads that disclosed file contents from the local system boo1138425...

Security update for GraphicsMagick (moderate)

openSUSE Security Update: Security update for GraphicsMagick Announcement ID: openSUSE-SU-2019:1619-1 Rating: moderate References: 1138425 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 An update that contains security fixes can now be installed. Description: This...

CVE-2019-12154

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions...

Zimbra Collaboration Suite Autodiscover XXE

Zimbra’s handling of Autodiscover requests is vulnerable to XML external entity attacks, which could allow file contents to be retrieved from the remote system. Recent assessments: jrobles-r7 at May 09, 2019 5:57pm UTC reported: Details According to the blog post A Saga of Code Executions on Zimb...

CVE-2019-9843

DiffPlug Spotless is affected by an XML External Entity (XXE) issue in the library and Maven plugin prior to 1.20.0 and in the Gradle plugin prior to 3.20.0. The XML parser resolves external entities over HTTP/HTTPS and ignores resolveExternalEntities, enabling potential disclosure of local files...

Omron CX-Supervisor Command Injection Vulnerability

Omron CX-Supervisor is a powerful and advanced machine visualization software package that provides a very flexible PC-based HMI environment. A command injection vulnerability exists in Omron CX-Supervisor 3.42 and earlier versions, which can be exploited by an attacker to inject commands via a...

Microsoft Visual Studio Multiple Information Disclosure Vulnerabilities (KB4476698, KB4476755)

This host is missing an important security update according to Microsoft Security Update January-2019. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Security Updates for Microsoft Visual Studio Products (January 2019)

The Microsoft Visual Studio Products are missing a security update. It is, therefore, affected by the following vulnerability : - An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file. An...

IBM Operational Decision Manager External Entity Injection (CVE-2018-1821)

An XML external entity XXE injection vulnerability exist in IBM Operational Decision. The vulnerability is due to a failure to properly handle external entity references in XML files. A remote attacker could exploit this vulnerability by enticing a target user into opening a crafted XML file with...

UBUNTU-CVE-2018-19968

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has...

Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20181127)

Security Fixes : - ghostscript: .tempfile file permission issues 699657 CVE-2018-15908 - ghostscript: shadingparam incomplete type checking 699660 CVE-2018-15909 - ghostscript: missing type check in type checker 699659 CVE-2018-16511 - ghostscript: incorrect access checking in temp file handling ...

glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c

It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service. If gluster multiplexing is enabled this will result in a crash of multiple bricks and gluster volumes...

Dell EMC RecoverPoint boxmgmt CLI Arbitrary File Read Vulnerability

The Dell EMC RecoverPoint Dell EMC RecoverPoint product provides continuous data protection for operational recovery and disaster recovery, which supports any-point-in-time recovery of diverse storage environments within and between data centers. An arbitrary file read vulnerability exists in the...

CMS Made Simple Remote Code Execution Vulnerability (CNVD-2018-08922)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A remote code execution vulnerability exists in th...

CVE-2018-1000124

I Librarian I-librarian version 4.8 and earlier contains a XML External Entity XXE vulnerability in line 154 of importmetadata.phpsimplexmlloadstring that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter...

CVE-2018-1000059

ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to execute unauthorised system commands remotely and disclose file contents in file system...

Design/Logic Flaw

ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to execute unauthorised system commands remotely and disclose file contents in file system...

CVE-2017-18083

The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of an uploaded file...

CVE-2014-6027

Multiple cross-site scripting XSS vulnerabilities in TorrentFlux 2.4 allow 1 remote attackers to inject arbitrary web script or HTML by leveraging failure to encode file contents when downloading a torrent file or 2 remote authenticated users to inject arbitrary web script or HTML via vectors...