7945 matches found
CVE-2022-0221
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system...
Security Bulletin: Vulnerabilities in Dojo and dom4j libraries affect Tivoli Netcool/OMNIbus WebGUI (CVE-2020-10683, CVE-2021-23450)
Summary Fix is available for vulnerabilities in Dojo and dom4j libraries affecting Tivoli Netcool/OMNIbus WebGUI CVE-2020-10683, CVE-2021-23450. Dojo is used by Tivoli Netcool/OMNIbus WebGUI as part of its web client component. dom4j was required by Tivoli Netcool/OMNIbus WebGUI as part of Apache...
CVE-2021-27777
XML External Entity XXE injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references...
Debian DLA-2972-1 : libxml2 - LTS security update
The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2972 advisory. Five security issues have been discovered in libxml2: XML C parser and toolkit. CVE-2016-9318 Vulnerable versions do not offer a flag directly indicating that the...
The vulnerability in the implementation of the extractor.rdfa.XSLTStylesheet object of the XSLTStylesheet class in the Apache Any23 library allows attackers to perform XXE attacks.
The vulnerability of the extractor.rdfa.XSLTStylesheet object class in the XSLTStylesheet class of the Apache Any23 library is related to an incorrect restriction on XML references to external objects. Exploiting this vulnerability could allow a remote attacker to perform XXE attacks...
CVE-2022-28219
Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution...
Schneider Electric SCADAPack Workbench isasln File Parsing XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric SCADAPack Workbench. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...
CVE-2022-1018
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of...
Xxe
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of...
CVE-2022-1018 ICSA-22-088-01 Rockwell Automation ISaGRAF
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of...
CVE-2022-1018
The CVE-2022-1018 issue is an XML External Entity (XXE) vulnerability in Rockwell Automation ISaGRAF ecosystem. When opening a malicious solution file, an unsafe DLL call may allow local file data to be sent to a remote web server, causing confidentiality loss. Affected products include Connected...
Improper Restriction of XML External Entity Reference in wutka jox
An XML External Entity XXE vulnerability exists in wutka jox 1.16 in the readObject method in JOXSAXBeanInput...
GHSA-FCRX-8829-JPQX Improper Restriction of XML External Entity Reference in wutka jox
An XML External Entity XXE vulnerability exists in wutka jox 1.16 in the readObject method in JOXSAXBeanInput...
Schneider Electric SCADAPack Workbench
1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: SCADAPack Workbench Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could result from exfiltration of data...
IBM Cognos Controller XML External Entity Injection Vulnerability (CNVD-2022-66264)
IBM Cognos Controller is a suite of business intelligence and planning solutions from IBM in the United States. The product features process automation, financial audit control, and the creation and management of financial reports. IBM Cognos Controller suffers from an XML external entity injecti...
IBM Cognos Controller XML External Entity Injection Vulnerability
IBM Cognos Controller is a suite of business intelligence and planning solutions from IBM in the United States. The product features process automation, financial audit control, and the creation and management of financial reports. IBM Cognos Controller suffers from an XML external entity injecti...
CVE-2021-43142
An XML External Entity XXE vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput...
CVE-2021-43142
An XML External Entity XXE vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput...