GHSA-Q7M6-WPVF-MVWX Mapfish Print: Remote Code Injection (RCE) in Dynamic table

Impact The attacker can execute arbitrary code without being authenticated Mitigation Upgrade to a patched version please check affected/patched version matrix Credits Bug Bounty of Canton du Jura...

EUVD-2020-0574

Malware in sbrugna...

EUVD-2020-0572

Malware in sbrugna...

CVE-2020-15232

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

CVE-2020-15231

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

Cross-Site Scripting (XSS)

mapfish-print is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via JSONP...

CVE-2020-15232

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

CVE-2020-15231

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

CVE-2020-15232

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

CVE-2020-15231

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

Cross site scripting

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

Xxe

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

CVE-2020-15232

The CVE-2020-15232 issue affects mapfish-print prior to version 3.24, where XML External Entity (XXE) processing is vulnerable via the SDL parser (DTDs are not disabled), enabling an attacker to inject untrusted entities. Public advisories describe remote XXE exploitation, with remediation statin...

CVE-2020-15232 XML External Entity attack in mapfish-print

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

CVE-2020-15231

CVE-2020-15231 affects mapfish-print prior to version 3.24. A JSONP misuse in mapfish-print allows Cross-site Scripting, enabling an attacker to inject and execute arbitrary JavaScript in a user’s browser via JSONP. Remediation per advisories is to upgrade to version 3.24 or later. The connected ...

XML External Entity (XXE)

mapfish-print is vulnerable to XML External Entity XXE. The vulnerability exists as the disallow-doctype-decl feature was not set in the removeIndexReference method used in SLDParserPlugin...

GHSA-W534-Q4XF-H5V2 XSS in Mapfish Print relating to JSONP support

Impact A user can use the JSONP support to do a Cross-site scripting. Patches Use version = 3.24 Workarounds No References https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e https://cwe.mitre.org/data/definitions/79.html For more information If you...

XSS in Mapfish Print relating to JSONP support

Impact A user can use the JSONP support to do a Cross-site scripting. Patches Use version = 3.24 Workarounds No References https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e https://cwe.mitre.org/data/definitions/79.html For more information If you...

XXE attack in Mapfish Print

Impact A user can do to an XML External Entity XXE attack with the provided SDL style. Patches Use version = 3.24 Workarounds No References https://cwe.mitre.org/data/definitions/611.html https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e For more...

GHSA-VJV6-GQ77-3MJW XXE attack in Mapfish Print

Impact A user can do to an XML External Entity XXE attack with the provided SDL style. Patches Use version = 3.24 Workarounds No References https://cwe.mitre.org/data/definitions/611.html https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e For more...