in alovoa/alovoa

✍️ Description Affected versions of this package are vulnerable to XML External Entity XXE Injection via the SAML2AssertionValidator method. Access to external entities was not disabled in XML parsing. 🕵️‍♂️ Proof of Concept org.springframework.security spring-security-oauth2-client...

Sql injection

Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance IDPA versions 2.0, 2.1, 2.2, 2.3 and 2.4. contain an XML External EntityXXE Injection vulnerability. A remote unauthenticated malicious user could potentially exploit this...

GHSA-24WF-7VF2-PV59 XXE vulnerability on Launch import with externally-defined DTD file

Impact Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity XXE attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition...

XXE vulnerability on Launch import with externally-defined DTD file

Impact Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity XXE attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition...

XML External Entity (XXE)

service-api is vulnerable to XML External Entity XXE. The vulnerability exists due to an insecure configuration in the XML parser. An attacker is able to import a malicious crafted file which imports external Document Type Definition DTD files which will extract secrets from the system...

CVE-2021-29620

Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity XXE attacks. This allows a user to import a specifically-crafted XML...

CVE-2021-29620 XXE vulnerability on Launch import with externally-defined DTD file

Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity XXE attacks. This allows a user to import a specifically-crafted XML...

EulerOS 2.0 SP3 : xerces-c (EulerOS-SA-2021-1862)

According to the version of the xerces-c package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not be...

ezXML 缓冲区错误漏洞

ezXML is a C library for parsing XML documents . An out-of-bounds write vulnerability exists in libezxml.a in ezXML version 0.8.6. The vulnerability stems from a memory handling error performed by the ezxmlinternaldtd function when parsing a specially crafted XML file. An attacker could use this...

UBUNTU-CVE-2021-30485

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxmlinternaldtd, while parsing a crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running strcmp on a NULL pointer...

CVE-2020-28387

A vulnerability has been identified in Solid Edge SE2020 All Versions SE2020MP13, Solid Edge SE2021 All Versions SE2021MP3. When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted...

Design/Logic Flaw

A vulnerability has been identified in Solid Edge SE2020 All Versions SE2020MP13, Solid Edge SE2021 All Versions SE2021MP3. When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted...

NewStart CGSL MAIN 6.02 : expat Multiple Vulnerabilities (NS-SA-2021-0083)

The remote NewStart CGSL host, running version MAIN 6.02, has expat packages installed that are affected by multiple vulnerabilities: - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and...

Xxe

SRS Policy Manager 6.X is affected by an XML External Entity Injection XXE vulnerability due to a misconfigured XML parser that processes user-supplied DTD input without sufficient validation. A remote unauthenticated attacker can potentially exploit this vulnerability to read system files as a...

CVE-2021-21517

SRS Policy Manager 6.X is affected by an XML External Entity Injection XXE vulnerability due to a misconfigured XML parser that processes user-supplied DTD input without sufficient validation. A remote unauthenticated attacker can potentially exploit this vulnerability to read system files as a...

CVE-2021-21517

CVE-2021-21517 affects Dell SRS Policy Manager 6.X, where an XML External Entity (XXE) vulnerability arises from a misconfigured XML parser that processes user-supplied DTD input without sufficient validation. This allows a remote, unauthenticated attacker to read system files as a non-root user ...

Dell SRS Policy Manager 代码问题漏洞

Dell SRS Policy Manager is an application from Dell USA. It provides Dell policy management features. A security vulnerability exists in SRS Policy Manager 6.X. The vulnerability stems from a misconfigured XML parser that fails to perform sufficient validation when processing user-supplied DTD...

CVE-2021-27184

Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability exploitable via the DTD parameter entities technique, resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input passed to...

CVE-2021-27184

Pelco Digital Sentry Server 7.18.72.11464 is vulnerable to XML External Entity (XXE) processing in DSControlPoint.exe when parsing ControlPointCacheShare.xml in %APPDATA% Pelco, enabling disclosure of arbitrary data on the affected node via an out-of-band (OOB) attack. Root cause is unsanitized i...

Debian DLA-2498-1 : xerces-c security update

The UK's National Cyber Security Centre NCSC discovered that Xerces-C, a validating XML parser library for C++, contains a use-after-free error triggered during the scanning of external DTDs. An attacker could cause a Denial of Service DoS and possibly achieve remote code execution. This flaw has...