65 matches found
GHSA-H892-X453-86WC Pippo RCE Vulnerability
Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling...
Pippo RCE Vulnerability
Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling...
Remote Code Execution
Pippo is vulnerable to remote code execution attacks. A remote, unauthenticated attacker could create a malicious object, base64 encode it, and place it in the PIPPOSESSION field of a cookie to exploit the flawed Cookie Handler component causing denial of service conditions. Affected by this issu...
com.gitblit.fathom:fathom-integration-test (>=0.6.0 <=1.0.1), ro.pippo:pippo-demo-ajax (>=0.6.0 <=0.6.1) +15 more potentially affected by CVE-2019-5442 via ro.pippo:pippo-jaxb (>=0.6.0 <=1.0.0)
ro.pippo:pippo-jaxb MAVEN version =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.1 and more Source cves: CVE-2019-5442 Source advisory: OSV:GHSA-HWCX-9P4J-7HWJ...
GHSA-HWCX-9P4J-7HWJ XML Entity Expansion in Pippo
XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...
XML Entity Expansion in Pippo
XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...
Denial Of Service (DoS)
Pippo Content Type Parent is vulnerable to denial of service. Pippo unsafely parses user provided XML as it allows user to provide DTD. The attacker thus could craft a malicious input to trigger a billion laughs attack, crashing the system...
Input validation
XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...
CVE-2019-5442
XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...
CVE-2019-5442
XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...
CVE-2019-5442
CVE-2019-5442 describes an XML Entity Expansion (Billion Laughs) vulnerability in Pippo 1.12.0 where untrusted XML parsing can trigger recursive entities via a DTD, causing DoS through excessive heap memory consumption and potential JVM memory exhaustion. Connected records confirm Pippo 1.12.0 as...
CVE-2019-5442
XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...
Central Security Project: Pippo XML Entity Expansion (Billion Laughs Attack)
Maven artifact groupId: ro.pippo artifactId: pippo-jaxb version: 1.12.0 Vulnerability Vulnerability Description Pippo unsafely parses user provided XML. The fromString in the ro.pippo.jaxb.JaxbEngine class allows user provided DTDs that the rest of the XML may reference. This can lead to recursiv...
com.gitblit.fathom:fathom-integration-test (>=0.5.0 <=1.0.1), com.gitblit.fathom:fathom-mailer (>=0.5.0 <=1.0.1) +72 more potentially affected by CVE-2018-20059 via ro.pippo:pippo-core (>=0.4.0 <=1.11.0)
ro.pippo:pippo-core MAVEN version =0.4.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.2, =0.8.1, =0.8.4, =0.8.0, =0.8.0, =0.2.3, =0.4.0, =0.4.0, =1.11.0 and more Source cves: CVE-2018-20059 Source advisory: OSV:GHSA-RMM5-G63H-M6G9...
GHSA-RMM5-G63H-M6G9 Improper Restriction of XML External Entity Reference in pippo-core
jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE...
Improper Restriction of XML External Entity Reference in pippo-core
jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE...
XML External Entity (XXE)
Pippo JAXB is vulnerable to XML external entity XXE. The XML parser does not disable the usage of external Document Type Definition DTD, allowing a remote attacker to perform XXE attacks via a crafted XML file...
CVE-2018-20059
jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE...