CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

Security Bulletin: IBM MQ Appliance is affected by a XML External Entity Injection (XXE) vulnerability (CVE-2018-1669)

Summary IBM MQ Appliance has addressed the following XML External Entity Injection XXE vulnerability. Vulnerability Details CVEID: CVE-2018-1669 DESCRIPTION: IBM WebSphere DataPower Appliances is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker...

SUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2017:1389-1)

This update for java-160-ibm fixes the following issues : - Version update to 6.0-16.45 bsc1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative...

PhpSpreadsheet < 1.5.0 - XML External Entity (XXE) Vulnerability

Exploit for php platform in category web applications Product Description PhpSpreadsheet is a library written in pure PHP that provides a set of classes allowing users to read from and write to different spreadsheet file formats, such as Excel and LibreOffice Calc. Vulnerabilities List One...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2018-1905)

Summary IBM WebSphere Application Server is shipped as a component of IBM Case Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...

Security Bulletin: IBM Operational Decision Manager is affected by CVE-2018-1821 vulnerability

Summary IBM Operational Decision Manager has addressed the vulnerability CVE-2018-1821 Vulnerability Details CVEID: CVE-2018-1821 DESCRIPTION: IBM Operational Decision Manager is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit thi...

IBM Operational Decision Manager 8.x - XML External Entity Injection

IBM Operational Decision Manager 8.x - XML External Entity Injection Exploit Title: XML External Entity Injection XXE Date: 2018-12-18 Exploit Author: Mohamed M.Fouad - From SecureMisr Company Vendor Homepage: https://www-01.ibm.com/support/docview.wss?uid=ibm10744149 Version: v8.6 - v8.7 - v8.8 ...

IBM Operational Decision Manager 8.x - XML External Entity Injection

Exploit Title: XML External Entity Injection XXE Date: 2018-12-18 Exploit Author: Mohamed M.Fouad - From SecureMisr Company Vendor Homepage: https://www-01.ibm.com/support/docview.wss?uid=ibm10744149 Version: v8.6 - v8.7 - v8.8 - v8.9 REQUIRED Tested on: Windows 10 CVE : CVE-2018-1821 POC1: Port...

IBM Operational Decision Manager 8.x - XML External Entity Injection

Exploit for multiple platform in category web applications Exploit Title: XML External Entity Injection XXE Exploit Author: Mohamed M.Fouad - From SecureMisr Company Vendor Homepage: https://www-01.ibm.com/support/docview.wss?uid=ibm10744149 Version: v8.6 - v8.7 - v8.8 - v8.9 REQUIRED Tested on:...

SDL Web Content Manager 8.5.0 - XML External Entity Injection Vulnerability

Exploit for php platform in category web applications Author Information Author : Ahmed Elhady Mohamed twitter : @AhmedELhady Company : Canon Security Date : 25/11/2018 Software Information Affected Software : SDL Web Content Manager Version: Build 8.5.0 Vendor: SDL Tridion Software website :...

OpenRefine XML External Entity Injection Vulnerability

OpenRefine is a standalone open source desktop application for data cleaning and converting data to other formats. An XML External Entity Injection XXE vulnerability exists in the data import function in OpenRefine versions 3.1 and earlier. The vulnerability can be exploited to read arbitrary fil...

CVE-2018-1821

IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150170...

CVE-2018-1821

IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150170...

CVE-2018-1920

IBM Marketing Platform 9.1.0, 9.1.2 and 10.1 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152855...

Xxe

IBM Marketing Platform 9.1.0, 9.1.2, and 10.1 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139029...

CVE-2018-1424

IBM Marketing Platform 9.1.0, 9.1.2, and 10.1 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139029...

CVE-2018-1424

IBM Marketing Platform 9.1.0, 9.1.2, and 10.1 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139029...

CVE-2018-1920

IBM Marketing Platform 9.1.0, 9.1.2 and 10.1 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152855...

CVE-2018-1730

IBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 147709...

Security Bulletin: IBM QRadar SIEM is vulnerable to XML External Entity Injection (CVE-2018-1730)

Summary The product does not disable external XML Entity Processsing which can lead to information disclosure and denial of service attacks. Vulnerability Details CVEID: CVE-2018-1730 Description: IBM QRadar is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A...