SAP NetWeaver BW - XML External Entity

Application: SAP BW Versions Affected: SAP BASIS 6.40/7.02 maybe others Vendor URL: http://www.sap.com Bugs:XML External Entity Exploits: YES Reported: 13.05.2011 Vendor response: 14.05.2011 Date of Public Advisory: 30.06.2012 Reference: SAP Security Note 1597066 Author: Alexey Tyurin ERPScan...

CVE-2011-1502

Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity aka XXE issue...

Design/Logic Flaw

Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity aka XXE issue...

CVE-2011-1502

Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity aka XXE issue...

CVE-2011-1502

CVE-2011-1502 affects Liferay Portal Community Edition 6.x up to 6.0.6 GA when deployed with Apache Tomcat. The vulnerability stems from an XML External Entity (XXE) issue: remote authenticated users can read arbitrary files by abusing an entity declaration with an entity reference. The available...

Ektron CMS400.net TransformXslt Web Service Directory Traversal

The installed version of Ektron CMS400.net ships with a web service that processes untrusted XML data and could allow an attacker to perform XML External Entity XXE attacks. Nessus was able to exploit this issue by sending a specially crafted request to the 'TransformXslt' web service, and retrie...

Adobe multiple server application information leak

It's possible to access loca files by AMFX request with XML External Entities...

Adobe Products XML External Entity And XML Injection

, , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Multiple Adobe Products XML External Entity And XML Injection Vulnerabilities CVE: CVE-2009-3960 Adobe PSIRT: APSB10-05 -...

Adobe (Multiple Products) - XML External Entity XML Injection

Adobe Multiple Products - XML External Entity XML Injection , , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Multiple Adobe Products XML External Entity And XML Injection Vulnerabilities CVE:...

Adobe Products XML External Entity And XML Injection Vulnerabilities

Exploit for unknown platform in category dos / poc ==================================================================== Adobe Products XML External Entity And XML Injection Vulnerabilities ==================================================================== Multiple Adobe Products XML External...

Design/Logic Flaw

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a...

CVE-2009-1699

The CVE-2009-1699 entry is confirmed in connected documents as a WebKit XXE vulnerability: qt4-x11 uses WebKit’s XSL stylesheet processing and does not properly handle XML external entities, enabling remote file disclosure via a crafted DTD (e.g., file:///… paths). Affected product/kit: Qt4-x11 w...

CVE-2009-1699

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a...

CVE-2009-1699

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a...

Apple Safari 3.2.x - XML External Entity Local File Theft

Safari prior to version 4 may permit an evil web page to steal files from the local system. This is accomplished by mounting an XXE attack against the parsing of the XSL XML. This is best explained with a sample evil XSL file which includes a DTD that attempts the XXE attack: Below you should see...

java-1.6.0 default external entity processing

The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity XXE attacks and cause a denial of service or acces...

Adobe Acrobat Reader local files access

By using XML External Entity document script can access local files and have them sent to remote site...

CVE-2005-1306

The Adobe Reader control in Adobe Reader and Acrobat 7.0 and 7.0.1 allows remote attackers to determine the existence of files via Javascript containing XML script, aka the "XML External Entity vulnerability."...

PT-2005-2309 · Adobe · Reader +1

Name of the Vulnerable Software and Affected Versions: Adobe Reader and Acrobat versions 7.0 through 7.0.1 Description: The issue allows remote attackers to determine the existence of files via Javascript containing XML script. This is related to the XML External Entity vulnerability...

CVE-2002-1252

The Application Messaging Gateway for PeopleTools 8.1x before 8.19, as used in various PeopleSoft products, allows remote attackers to read arbitrary files via certain XML External Entities XXE fields in an HTTP POST request that is processed by the SimpleFileHandler handler...