63 matches found
CVE-2022-41954 Temporary File Information Disclosure Vulnerability
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems not Windows or macos, MPXJ's use of File.createTempFile.. results in temporary files being created with the permissions -rw-r--r--. This means that any other...
CVE-2022-41954 Temporary File Information Disclosure Vulnerability
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems not Windows or macos, MPXJ's use of File.createTempFile.. results in temporary files being created with the permissions -rw-r--r--. This means that any other...
Improper Restriction of XML External Entity Reference in MPXJ
"MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components."...
GHSA-WCP5-M52F-MHH5 Improper Restriction of XML External Entity Reference in MPXJ
"MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components."...
The vulnerability of the GanttProjectReader and PhoenixReader components of the MPXJ library, which allows attackers to carry out XXE attacks
The vulnerability of the GanttProjectReader and PhoenixReader components in the MPXJ library is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to perform XXE attacks remotely...
The vulnerability in the function of the common/InputStreamHelper.java library of the MPXJ library allows a hacker to write files to arbitrary locations.
The vulnerability in the common/InputStreamHelper.java library of the MPXJ library exists due to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to write files to arbitrary locations...
MPXJ path Traversal vulnerability
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
GHSA-P9J6-4PJR-GP48 MPXJ path Traversal vulnerability
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
Arbitrary File Write
Packwood MPXJ is vulnerable to arbitrary file write. The vulnerability exists because it does not properly validate the path from inputStream, leading to the writing of files outside of the target directory...
CVE-2020-35460
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
CVE-2020-35460
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
Directory traversal
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
CVE-2020-35460
CVE-2020-35460 : In MPXJ (Packwood), the InputStreamHelper.java component allows directory traversal in the zip stream handler flow, enabling writing files to arbitrary locations. This is due to insufficient validation of pathnames in the traversal path. Affected file/component: common/InputStrea...
CVE-2020-35460
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
CVE-2020-35460
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
XML External Entity (XXE)
mpxj is vulnerable to XML external entity attacks. The XMLFilter is configured with external DTDs by default, allowing an attacker to perform XXE attacks to access system files or perform requests on behalf of the server...
CVE-2020-25020
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...
CVE-2020-25020
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...