CVE-2015-0263

XML external entity XXE vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource...

Xxe

Multiple XML external entity XXE vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML 1 String or 2 GenericFile object in an XPath query...

Xxe

XML external entity XXE vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource...

CVE-2015-0263

XML external entity XXE vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource...

CVE-2015-0264

Multiple XML external entity XXE vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML 1 String or 2 GenericFile object in an XPath query...

CVE-2015-0263

Apache Camel contains an XXE in the XML converter setup (converter/jaxp/XmlConverter.java) affecting versions before 2.13.4 and 2.14.x before 2.14.2, allowing remote attackers to read arbitrary files via an external entity in SAXSource. Remediation: upgrade to Camel 2.13.4+ or 2.14.2+. Exploitati...

CVE-2015-0264

CVE-2015-0264: In Apache Camel, multiple XXE vulnerabilities exist in builder/xml/XPathBuilder.java that allow reading arbitrary files when processing invalid XML strings or GenericFile objects via an XML External Entity (XXE) declaration. Affected versions are Camel before 2.13.4 and 2.14.x befo...

CVE-2015-0263

XML external entity XXE vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource...

CVE-2015-0264

Multiple XML external entity XXE vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML 1 String or 2 GenericFile object in an XPath query...

CVE-2015-0263: Undefined Security Weakness

XML external entity XXE vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource...

CVE-2015-0264: Undefined Security Weakness

Multiple XML external entity XXE vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML 1 String or 2 GenericFile object in an XPath query...

PT-2015-4551

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.13.4 Apache Camel versions 2.14.x prior to 2.14.2 Description The issue is related to an XML external entity XXE vulnerability in the XML converter setup. This allows remote attackers to read arbitrary files vi...

PT-2015-4552

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.13.4 Apache Camel versions 2.14.x prior to 2.14.2 Description The issue allows remote attackers to read arbitrary files via an external entity in an invalid XML String or GenericFile object in an XPath query...

Moderate: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 update

Red Hat JBoss Fuse and A-MQ 6.1.0 Patch 4 on Rollup Patch 2 R2P4, which fixes two security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerabilit...

Camel: XXE in via SAXSource expansion

It was found that Apache Camel's XML converter performed XML External Entity XXE expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

Camel: XXE via XPath expression evaluation

It was found that Apache Camel performed XML External Entity XXE expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and...

Apache Camel XPath Arbitrary File Read Vulnerability

Apache Camel is an open source project under the Apache Foundation , it is a rule-based routing and mediation engine that provides an enterprise integration model of the implementation of the Java object , through the application program interface or known as declarative Java domain-specific...

Apache Camel XSLT Component Java Code Execution (CVE-2014-0003)

A code execution vulnerability has been reported in Apache Camel. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted XML message to the vulnerable server. Successful exploitation could result in the execution of arbitrary Java code...

Camel: XML eXternal Entity (XXE) flaw in XSLT component

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...

Camel: remote code execution via XSL

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message...