1210 matches found
CVE-2024-47582
Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application...
CVE-2024-47582
CVE-2024-47582 affects SAP NetWeaver Application Server for Java. The root cause is missing validation of XML input, enabling an unauthenticated attacker to send malicious XML to an endpoint, triggering an XML Entity Expansion attack with limited impact on availability. The vulnerability is descr...
CVE-2024-47582 XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA
Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application...
PT-2024-32663 · Sap Se · Sap Netweaver As Java
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to missing validation of XML input, which allows an unauthenticated attacker to send malicious input to an endpoint. This leads to ...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS via the GMLASReader class due to improper entity expansion restrictions. Exploiting this vulnerability is possible when parsing specially crafted XML files with recursive entity definitions. Details Denial of Servi...
Denial of Service (DoS)
Overview GDAL is a number of tools for programming and manipulating the GDAL Geospatial Data Abstraction Library. Affected versions of this package are vulnerable to Denial of Service DoS via the GMLASReader class due to improper entity expansion restrictions. Exploiting this vulnerability is...
XML Entity Injection Vulnerability in U8Cloud of UFIDA Network Technology Co.
U8cloud is a new-generation cloud ERP launched by UFIDA, which mainly focuses on growing and innovative enterprises and provides enterprise-level cloud ERP total solutions. UFIDA U8Cloud suffers from an XML entity injection vulnerability that can be exploited by attackers to obtain sensitive...
XML Entity Injection Vulnerability in UFIDA NC at UFIDA Network Technology Co.
UFIDA NC is a comprehensive business management software for large enterprises. An XML entity injection vulnerability exists in UFIDA NC, which can be exploited by attackers to obtain sensitive information...
CVE-2020-26066
A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...
IBM Engineering Lifecycle Optimization 代码问题漏洞
IBM Engineering Lifecycle Optimization ELO is an extension of the Engineering Lifecycle Management ELM portfolio from International Business Machines IBM. They make it easier to collect and analyze data across the development environment to make better decisions. Automate reporting to ensure that...
Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2024-2807)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
XML Entity Injection Vulnerability in Secure Data Exchange System of Shenzhen UnitedSoft Technology Co.
Ltd. "LianSoft" was founded in 2004, focusing on enterprise-level network security market, providing network security products and services for government and enterprise customers, to create a network access control, terminal security management, data leakage prevention products such as integrate...
EulerOS 2.0 SP9 : expat (EulerOS-SA-2024-2827)
According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time.CVE-2023-52426 An issue was discovered in libexp...
HAPI FHIR 安全漏洞
HAPI FHIR is a Java-written HL7 FHIR API for the HAPI FHIR open source. A security vulnerability exists in HAPI FHIR versions prior to v6.4.0 that stems from the presence of an external entity reference that allows an attacker to access sensitive information or execute arbitrary code by providing...
RHEL 7 : python-defusedxml and python-pysaml2 (RHSA-2017:0937)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:0937 advisory. The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes...
CVE-2024-51136
The CVE-2024-51136 entry describes an XML External Entity (XXE) vulnerability in OpenIMAJ’s Dmoz2CSV component for OpenIMAJ v1.3.10. The root cause is improper handling of external entities in XML files, enabling an attacker to read sensitive data or potentially execute arbitrary code by supplyin...
Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2024-2664)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-39586
Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially exploit this vulnerability, leading to information disclosure...
rexml: DoS vulnerability in REXML
A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file...