PT-2022-25250 · Fasterxml · Fasterxml/Woodstox

Name of the Vulnerable Software and Affected Versions: Xstream affected versions not specified FasterXML/woodstox affected versions not specified Description: The issue allows an attacker to cause a denial of service attack by supplying content that causes the parser to crash due to a stack...

PT-2022-25248 · Xstream · Xstream

Name of the Vulnerable Software and Affected Versions: Xstream affected versions not specified Description: The issue allows for Denial of Service attacks when the parser is running on user-supplied input. An attacker may supply content that causes the parser to crash by stackoverflow, supporting...

DEBIAN-CVE-2022-33977

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service DoS condition on the server where the...

PYSEC-2022-243

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service DoS condition on the server where the...

CVE-2022-33977

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service DoS condition on the server where the...

untangle 安全漏洞

untangle is a package from the individual developer Christian Stefanescu in Germany. It is used to convert XML to Python objects. A security vulnerability exists in untangle, which stems from improper restriction of XML entities in DTDs. A remote attacker could use this vulnerability to send a...

XML External Entity (XXE)

org.eclipse.lyo.oslc4j.core:oslc4j-jena-provider is vulnerable to XML external entity attack. Default initialization of createTransformer does not restrict DTD document loading when working with RDF/XML formats, which allows remote attackers to retrieve external DTD documents...

XML External Entity Reference in Eclipse Lyo

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved...

CVE-2021-41042

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved...

Code injection

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved...

CVE-2021-41042

Eclipse Lyo versions 1.0.0–4.1.0 are affected by CVE-2021-41042 due to a TransformerFactory initialized with defaults that do not restrict DTD loading for RDF/XML. This enables an attacker to cause an external DTD to be retrieved, leading to potential information exposure (external entity referen...

CVE-2021-41042

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved...

CVE-2021-40510

CVE-2021-40510 affects OBDA system Mastro 1.0. It is an XML External Entity (XXE) vulnerability that allows remote attackers to read system files via crafted DTDs. The NVD entry indicates network access with low complexity and no authentication (CVSS3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; base ...

Design/Logic Flaw

An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker ca...

CVE-2022-31261

CVE-2022-31261 concerns Morpheus Data (versions 5.2.16 and 5.4.x prior to 5.4.4) with an XML External Entity (XXE) vulnerability. According to connected Red Hat and NVD records, an attacker must configure a SAML identity provider and know the unique SAML callback ID. A remote attacker can send a ...

Morpheus Data Morpheus 代码问题漏洞

Morpheus Data Morpheus is a powerful self-service engine from Morpheus Data USA, Inc. that delivers enterprise agility, control and efficiency. A security vulnerability exists in Morpheus Data Morpheus version 5.2.16 and version 5.4.x prior to version 5.4.4, which stems from the discovery of an X...

Improper Input Validation in Apache Axis2

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...

GHSA-WP35-6JQV-R33M Apache XML-RPC XXE Vulnerability

XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery SSRF attacks via a crafted DTD...

Apache XML-RPC XXE Vulnerability

XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery SSRF attacks via a crafted DTD...

GHSA-V8Q2-94F6-6XQ2 Improper Input Validation in Apache CXF

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send...