178 matches found
XML External Entity (XXE)
checkstyle is vulnerable to XML external entity attacks. External DTDs are not disabled by default, allowing an attacker to inject malicious XML to retrieve system files or submit requests on behalf of the server to gain access to the internal network...
NewStart CGSL CORE 5.04 / MAIN 5.04 : xerces-c Vulnerability (NS-SA-2019-0072)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xerces-c packages installed that are affected by a vulnerability: - A stack exhaustion flaw was found in the way Xerces-C XML parser handled deeply nested DTDs. An attacker could potentially use this flaw to crash an...
XML External Entity (XXE)
nablarch is vulnerable to XML external entity XXE attacks. Lack of validation and permitting of external DTDs in XML submissions allows an attacker to perform XXE attacks...
CVE-2019-3722
Dell EMC OpenManage Server Administrator OMSA versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity XXE injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to read arbitrary server system files by supplying specially...
EulerOS Virtualization for ARM 64 3.0.2.0 : libxml2 (EulerOS-SA-2019-1614)
According to the versions of the libxml2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There ...
EulerOS Virtualization 3.0.1.0 : libxml2 (EulerOS-SA-2019-1559)
According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs...
Fedora 29 : checkstyle (2019-e4405b4c9f)
This update fixes security vulnerability - Checkstyle loads external DTDs by default. Upstream issue : https://github.com/checkstyle/checkstyle/issues/6474 https://github.com/checkstyle/checkstyle/issues/6478 References : https://checkstyle.org/releasenotes.htmlRelease8.18 Note that Tenable Netwo...
CVE-2019-9658
Checkstyle before 8.18 loads external DTDs by default...
Default credentials
Checkstyle before 8.18 loads external DTDs by default...
CVE-2019-9658
Checkstyle before 8.18 loads external DTDs by default...
CVE-2019-9658
Checkstyle before 8.18 loads external DTDs by default...
CVE-2019-9658
CVE-2019-9658 affects Checkstyle (com.puppycrawl.tools:checkstyle). Multiple connected sources confirm that versions prior to 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658. The root cause is an incomplete/partial mitigation in the earlier fi...
CVE-2019-9658
Checkstyle before 8.18 loads external DTDs by default...
Denial Of Service (DoS) Memory Consumption
Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service memory consumption via crafted Document Type Definitions DTDs, related to signatures...
High severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3
Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations DTDs when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters...
GHSA-VQ9J-JH62-5HMP Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...
CVE-2018-11048
Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance IDPA versions 2.0, 2.1 contain a XML External Entity XXE Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to...
[SECURITY] Fedora 27 Update: libxml2-2.9.8-4.fc27
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...
[SECURITY] Fedora 28 Update: libxml2-2.9.8-4.fc28
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...