Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Rational ClearQuest (CVE-2017-1289)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6, 7, and 8, which are used by IBM Rational ClearQuest. These issues were disclosed as part of the IBM Java SDK updates in April 2017. Vulnerability Details CVEID: CVE-2017-1289 DESCRIPTION: IBM SDK, Java...

CVE-2019-3773

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-10782

All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity XXE Injection due to an incomplete fix for CVE-2019-9658...

CVE-2019-10782

All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity XXE Injection due to an incomplete fix for CVE-2019-9658...

Security Bulletin: A security vulnerability was fixed in IBM Security Access Manager

Summary A XML External Entity Injection vulnerability was fixed in ISAM 9.0.7.1 Vulnerability Details CVEID: CVE-2019-4707 DESCRIPTION: IBM Security Access Manager Appliance is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...

Easy XML Editor 1.7.8 - XML External Entity Injection

Easy XML Editor 1.7.8 - XML External Entity Injection Exploit Title: Easy XML Editor 1.7.8 - XML External Entity Injection Exploit Author: Javier Olmedo Date: 2018-11-21 Vendor: Richard Wuerflein Software Link: https://www.edit-xml.com/EasyXMLEditor.exe Affected Version: 1.7.8 and before Patched...

Easy XML Editor 1.7.8 - XML External Entity Injection

Exploit Title: Easy XML Editor 1.7.8 - XML External Entity Injection Exploit Author: Javier Olmedo Date: 2018-11-21 Vendor: Richard Wuerflein Software Link: https://www.edit-xml.com/EasyXMLEditor.exe Affected Version: 1.7.8 and before Patched Version: unpatched Category: Local Platform: XML Teste...

MSN Password Recovery 1.30 - XML External Entity Injection Vulnerability

Exploit Title: MSN Password Recovery 1.30 - XML External Entity Injection Exploit Author: ZwX Vendor Homepage : https://www.top-password.com/ Software Link: https://www.top-password.com/download/MSNPRSetup.exe Tested on OS: Windows 10 + Exploit : PoC =================== 1 python -m SimpleHTTPServ...

Xxe

XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is: XML Validate function. The attack vector is: Specially crafted XML payload...

CVE-2019-19032

XMLBlueprint XML Editor version 16.191112 and earlier is affected by XML External Entity (XXE) Injection (CVE-2019-19032). A crafted XML payload can trigger the XML Validate function to read arbitrary files, enabling Arbitrary File Read during validation. The vulnerability is linked to the XML Ex...

CVE-2019-19031

Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload...

CVE-2019-19031

CVE-2019-19031 affects Easy XML Editor up to version 1.7.8 (and earlier). The issue is an XML External Entity Injection in the XML parsing component, triggered by a specially crafted XML payload. Ranked with high impact in CVSS 3.1: high confidentiality and availability impacts (C:H, A:H) and net...

Security Bulletin: 10x Vulnerability in IBM Control Center Could Allow Potential XML External Entity (XXE) Injection

Summary IBM Control Center has addressed the following vulnerability: A potential XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID:...

CVE-2019-19702

The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML...

CVE-2019-19702

The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML...

PYSEC-2019-105

The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML...

Xxe

The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML...

CVE-2019-19702

The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML...

Microsoft Visual Basic 2010 Express - XML External Entity Injection

Microsoft Visual Basic 2010 Express - XML External Entity Injection Exploit Title: Microsoft Visual Basic 2010 Express - XML External Entity Injection Exploit Author: ZwX Exploit Date: 2019-12-03 Version Software : 10.0.30319.1 RTMRel Vendor Homepage : https://www.microsoft.com/ Software Link:...

Microsoft Excel 2016 1901 - XML External Entity Injection

Microsoft Excel 2016 1901 - XML External Entity Injection Exploit Title: Microsoft Excel 2016 1901 - XML External Entity Injection Discovery by: hyp3rlinx Date: 2019-12-02 Vendor Homepage: www.microsoft.com Tested Version: 2016 v1901 CVE: N/A + Credits: John Page aka hyp3rlinx + Website:...