CVE-2015-7400

The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service CPU consumption via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Xxe

The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service CPU consumption via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2015-7400

CVE-2015-7400 affects the Lotus Mashups component in IBM Mashup Center 3.0.0.1, causing a denial of service via XML External Entity (XXE) processing when handling XML data. The issue is exploitable by remote authenticated users and is tied to XXE. IBM BPM/Cloud Orchestrator bulletins indicate thi...

CVE-2015-7400

The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service CPU consumption via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

OpenMRS 2.3 (1.11.4) - XML External Entity Processing

OpenMRS 2.3 1.11.4 - XML External Entity Processing !/usr/bin/env python OpenMRS 2.3 1.11.4 XML External Entity XXE Processing PoC Exploit Vendor: OpenMRS Inc. Product web page: http://www.openmrs.org Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 Platform 1.11.4 Build 6ebcaf, 1.11.2 and 1.10.0...

Camel: XXE via XPath expression evaluation

It was found that Apache Camel performed XML External Entity XXE expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and...

batik: XML External Entity (XXE) injection in SVG parsing

It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

Critical: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.2.0 update

Red Hat JBoss BPM Suite 6.2.0, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores...

CVE-2015-5319

XML external entity XXE vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job...

CVE-2015-5319

CVE-2015-5319 is an XXE vulnerability in Jenkins’ create-job CLI that allows remote reading of arbitrary files by crafting a job configuration, which is then used by an XML-aware tool (e.g., get-job, update-job). Affected products/versions include Jenkins before 1.638 and LTS before 1.625.2. The ...

SAP Sybase Adaptive Server Enterprise XML External Entity Information Disclosure Vulnerability

SAP Sybase Adaptive Server Enterprise suffers from an XXE injection vulnerability. source: http://www.securityfocus.com/bid/63193/info SAP Sybase Adaptive Server Enterprise is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive...

Arbitrary file upload and XML External Entity processing

More info at https://www.neos.io/blog/flow-sa-2015-001.html...

SAP NetWeaver 7.4 XXE Injection Vulnerability

SAP NetWeaver version 7.4 suffers from an XML external entity injection vulnerability. Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 16.04.2015 Reported: 16.04.2015 Vendor response: 16.04.2015 Date of...

SAP Mobile Platform 2.3 XXE Injection

Application: SAP Mobile Platform 2.3 Versions Affected: SAP Mobile Platform 2.3, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 25.02.2015 Reported: 25.02.2015 Vendor response: 25.02.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2152227 Author:...

SAP NetWeaver 7.4 XXE Injection

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 16.04.2015 Reported: 16.04.2015 Vendor response: 16.04.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2168485 Author: Roman Bezhan...

VMware product updates address information disclosure issue.

a. vCenter Server, vCloud Director, Horizon View information disclosure issue VMware products that use Flex BlazeDS may be affected by a flaw in the processing of XML External Entity XXE requests. A specially crafted XML request sent to the server could lead to unintended information be disclosed...

SolarWinds Log and Event Manager XML External Entity Injection Vulnerability

SolarWinds Log and Event Manager LEM is vulnerable to an Extensible Markup Language XML external entity injection SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PT-2015-18: XML External Entity Injection in 1С:Enterprise

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in the 1C: Enterprise application. This vulnerability allows an attacker to access the internal network resources, file system, and cause a denial of service attack. All XML parsers are...

Google AdWords 6.2.0 API client libraries - XML eXternal Entity Injection

Date: 06.11.2015 Exploit Author: Dawid Golunski Vendor Homepage: https://developers.google.com/adwords/api/docs/clientlibraries Software Link: https://github.com/googleads/googleads-php-lib Version: Google AdWords API client libraries - XML eXternal Entity Injection XXE...

SolarWinds Log and Event Manager XML External Entity Injection Vulnerability

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. An XML external entity injection vulnerability exists in SolarWinds Log and Event Manager, which could be exploited by an attacker to obtain...