Ektron CMS 'ServerControlWS.asmx' XML External Entity Injection Vulnerability

Ektron CMS is a content management system. An external entity injection vulnerability exists in the Ektron CMS 'ServerControlWS.asmx' XML due to the application failing to properly filter user-supplied input before dynamically generating content. An attacker could use this vulnerability to read t...

ActiveMQ: XXE via XPath expression evaluation

It was discovered that Apache ActiveMQ performed XML External Entity XXE expansion when evaluating XPath expressions. A remote, attacker-controlled consumer able to specify an XPath-based selector to dequeue XML messages from an Apache ActiveMQ broker could use this flaw to read files accessible ...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 security and bug fix update

Red Hat JBoss Fuse and A-MQ 6.1.0 Patch 3 on Rollup Patch 1 R1P3, which fixes two security issues and one bug, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base score...

ActiveMQ: XXE via XPath expression evaluation

It was discovered that Apache ActiveMQ performed XML External Entity XXE expansion when evaluating XPath expressions. A remote, attacker-controlled consumer able to specify an XPath-based selector to dequeue XML messages from an Apache ActiveMQ broker could use this flaw to read files accessible ...

RESTEasy: XXE via parameter entities

It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible...

CVE-2015-0581

The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related ...

CVE-2015-0581

The CVE-2015-0581 issue affects Cisco Prime Service Catalog prior to 10.1, where the XML parser is vulnerable to an XML External Entity (XXE) attack. Remote authenticated users can read arbitrary files or trigger a denial of service (CPU/memory consumption) by crafting an external entity declarat...

CVE-2015-0581

The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related ...

PicketLink: XXE via insecure DocumentBuilderFactory usage

It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the...

SAP NetWeaver AS ABAP XML External Entity Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications.SAP Netweaver AS ABAP is an application server that runs in NetWeaver and is based on the ABAP high-level programming language. An XML external...

CVE-2015-1309

XML external entity vulnerability in the Extended Computer Aided Test Tool eCATT in SAP NetWeaver AS ABAP 7.31 and earlier allows remote attackers to access arbitrary files via a crafted XML request, related to ECATTDISPLAYXMLSTRINGREMOTE, aka SAP Note 2016638...

CVE-2014-6577

Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not...

CVE-2014-8790

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

CVE-2014-8790

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

Oracle Solaris Third-Party Patch Update : modsecurity (cve_2012_2751_improper_input)

The remote Solaris system is missing necessary patches to address security updates : - ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data...

Xxe

XML external entity XXE vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint...

CVE-2014-0171

An XXE vulnerability (CVE-2014-0171) affects StaxXMLFactoryProvider2 in Odata4j used by Red Hat JBoss Data Virtualization prior to 6.0.0 patch 4. The flaw lets a remote attacker submit a crafted XML payload via a REST endpoint that resolves external entities and can read arbitrary files on the se...

McAfee ePolicy Orchestrator XML External Entity Vulnerability

McAfee ePolicy Orchestrator is a set of scalable security management software from the U.S. company McAfee McAfee. An XML external entity vulnerability exists in McAfee ePolicy Orchestrator versions prior to 4.6.9, and 5.x versions prior to 5.1.2, which could allow an authenticated, remote attack...

Odata4j: XML eXternal Entity (XXE) flaw

It was found that Odata4j permitted XML eXternal Entity XXE attacks. If a REST endpoint was deployed, a remote attacker could submit a request containing an external XML entity that, when resolved, allowed that attacker to read files on the application server in the context of the user running th...

CVE-2014-6212

The Echo API in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix11, 10.0.0.x before 10.0.0.1 iFix12, 10.0.1.x before 10.0.1.5 iFix2, and 10.0.2.x before 10.0.2.2 iFix5; Emptoris Sourcing 9.5 before 9.5.1.3 iFix2, 10.0.0.x before 10.0.0.1 iFix1, 10.0.1.x before 10.0.1.3 iFix1, and 10.0.2...