447 matches found
GHSA-84P2-VF58-XHXV Billion laughs attack in c3p0
c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...
Billion laughs attack in c3p0
c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...
DEBIAN-CVE-2019-5427
c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...
UBUNTU-CVE-2019-5427
c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...
Design/Logic Flaw
c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...
CVE-2019-5427
CVE-2019-5427 affects c3p0, where versions older than 0.9.5.4 are vulnerable to a billion laughs (XML entity expansion) attack when loading XML configuration due to missing protections against recursive entity expansion. Public sources in connected documents confirm the issue exists in c3p0
CVE-2019-5427
c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...
Starbucks: SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database
As described in the Hacker Summary, @spaceraccoon discovered a SQL Injection vulnerability in a web service backed by Microsoft Dynamics AX. @spaceraccoon demonstrated that the flaw was exploitable via XML-formatted HTTP payload requests to the server. We appreciate @spaceraccoon's clear and...
UC Browser is the presence of man in the middle attacks(MITM)vulnerability that could impact more than a billion devices-vulnerability warning-the black bar safety net
Researchers find UC Browser in the presence of a vulnerable functional block can be exploited by attackers to perform MiTM attacks. Because the UC Browser using the HTTP Protocol to communicate with the server, the transmission information is not encrypted, so the would be attacker hook request...
Central Security Project: c3p0 may be exploited by a Billion Laughs Attack when loading XML configuration
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Please refer to the example on our poli...
Central Security Project: Pippo XML Entity Expansion (Billion Laughs Attack)
Maven artifact groupId: ro.pippo artifactId: pippo-jaxb version: 1.12.0 Vulnerability Vulnerability Description Pippo unsafely parses user provided XML. The fromString in the ro.pippo.jaxb.JaxbEngine class allows user provided DTDs that the rest of the XML may reference. This can lead to recursiv...
Android Is Helping Kill Passwords on a Billion Devices
By officially certifying the FIDO2 standard, the mobile OS will soon allow logins to sites and services without having to put in a password...
World’s largest data dump surfaces on web with 2.2 billion accounts
By Waqas It hasn’t even been 15 days since details of the world’s biggest online private data dump were discovered by security researchers and now its second "installment" has posted online. As per the report from Heise.de, a German-language website, the first collection, which was published on...
Billion Laugh Attack in https://sites.google.com
tl;dr https://sites.google.com suffered from a Billion Laugh Attack vulnerability that made the containerized environment to crash with a single invocation. Introduction Few months ago I applied for a talk at a security conference titled So you wanna be a Bug Bounty Hunter but it was rejected :...
Denial Of Service (DoS)
libdbus-c++.so is vulnerable to denial of service. The expansion of internal XML entities in the Expat-based XML parser is not disabled and potentially allows a remote attacker to cause a denial of service condition via billion laughs attack...
As Predicted, Mobile Continued eCommerce Dominance Over the Holiday Weekend
Akamai predicted in September 2018 that mobile shopping would continue its growth this holiday shopping season. That prediction held true as we saw mobile devices increase their share of Black Friday online shopping traffic volume to 57.55%, with desktop traffic dropping to 35.91%. And for the...
IBM acquiring Red Hat for a whopping $34 billion
By Waqas IBM International Business Machine is acquiring the world-renowned provider of open source cloud software Red Hat, Inc., for a whopping $34 billion, the news about the deal was announced on Sunday. IBM plans to pay $34 billion in cash for $190.00 per share. After the deal, Red Hat will...
Billion ADSL Router 400G 20151105641 - Cross-Site Scripting Vulnerability
Exploit for hardware platform in category web applications Exploit Title: Billion ADSL Router 400G 20151105641 - Cross-Site Scripting Author: Cakes Vendor Homepage: http://www.billion.com Software Link: http://billionfirmware.co.za Tested Version: 20151105641 Tested on OS: Kali Linux CVE: N/A...
Billion ADSL Router 400G 20151105641 - Cross-Site Scripting
Billion ADSL Router 400G 20151105641 - Cross-Site Scripting Exploit Title: Billion ADSL Router 400G 20151105641 - Cross-Site Scripting Author: Cakes Discovery Date: 2018-09-30 Vendor Homepage: http://www.billion.com Software Link: http://billionfirmware.co.za Tested Version: 20151105641 Tested on...