CVE-2020-27858

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getNews method. Due to the improper restriction of XML External Entity...

CVE-2020-27858

CVE-2020-27858 affects CA Arcserve D2D 16.5. A flaw in the getNews method arises from improper restriction of XML External Entity (XXE) references, allowing remote attackers to disclose sensitive information in the context of SYSTEM without authentication. The exploitation path is via a crafted X...