2262 matches found
Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references
Overview Several Java implementations of AMF3 are vulnerable to insecure deserialization and XML external entities references. Description Several Java implementations of Action Message Format AMF3 are vulnerable to one or more of the following implementation errors:CWE-502: Deserialization of...
apache-cxf: Atom entity provider of Apache CXF JAX-RS is vulnerable to XXE
Apache CXF JAX-RS implementation provides a number of Atom MessageBodyReaders. These readers use Apache Abdera Parser to parse Atom feeds or Entries, with this Parser expanding XML entities by default. It was found that this represents a major XXE risk...
Lines Around Cyber Threat Intelligence Sharing Blurring
SINT MAARTEN—The rift between between threat intelligence services, private companies, and the government is getting muddier around information sharing. Catherine Lotrionte, the Associate Director of the Institute for Law, Science and Global Security at Georgetown University, described the some o...
CVE-2017-5643
It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...
Server-Side Request Forgery (SSRF)
Apache Camel is vulnerable to Server-Side Request Forgery SSRF via remote DTDs URLs or XML External Entities XXE. This is because the validation component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can...
Microsoft Active Directory Federation Services Information Disclosure
An information disclosure vulnerability exists when Windows Active Directory Federation Services ADFS honors XML External Entities. An authenticated attacker who successfully exploited this vulnerability would be able to read sensitive information about the target system. To exploit this conditio...
KLA10986 Information disclosure vulnerability in Microsoft Active Directory Federation Services
An improper honoring of XML External Entities was found in Microsoft Active Directory Federation Services ADFS. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a specially designed request. Original advisories...
PT-2017-4234
Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.5 Description The issue is related to infinite recursion in parameter entities, which can be exploited by a remote attacker to cause a denial of service. Recommendations For versions prior to 2.9.5, update to...
New York State Implements Cybersecurity Regulation 23 NYCRR 500
On March 1st, 2017, sweeping new cybersecurity requirements were placed on organizations regulated by the New York State Department of Financial Services. The law applies to a broad set of covered entities that are supervised by the NYDFS, including banks, trusts, budget planners, check cashers,...
Grails PDF Plugin XML External Entity Information Disclosure Vulnerability
Grails PDF Plugin XML External Entity Information Disclosure vulnerability. An attacker can exploit the vulnerability to obtain sensitive information, which could lead to further attacks...
Data Stealing Malware TeamSpy Resurfaces in Spam Campaign
After almost a four-year respite, the data-stealing TeamSpy malware has resurfaced, or at least that’s what a spam campaign detected over the weekend suggests, researchers say. Researchers at the CrySyS Lab in Hungary originally identified the malware back in March 2013 when they traced it back t...
DEBIAN-CVE-2017-5992
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...
CVE-2017-5992
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...
PYSEC-2017-48
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...
PYSEC-2017-48
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...
UBUNTU-CVE-2017-5992
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...
CVE-2017-5992
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...
Cimetrics BACnet Explorer 4.0 XXE Injection
Cimetrics BACnet Explorer 4.0 XXE Vulnerability Vendor: Cimetrics, Inc. Product web page: https://www.cimetrics.com Affected version: 4.0.0.0 Summary: The BACnet Explorer is a BACnet client application that helps auto discover BACnet devices. Desc: BACnetExplorer suffers from an XML External Enti...
Check Box 2016 Q2 Survey - Multiple Vulnerabilities
Check Box 2016 Q2 Survey - Multiple Vulnerabilities Exploit Title: Check Box 2016 Q2 Survey Multiple Vulnerabilities Exploit Author: Fady Mohamed Osman @fadyosman Exploit-db : http://www.exploit-db.com/author/?a=2986 Youtube : https://www.youtube.com/user/cutehack3r Date: Jan 17, 2017 Vendor...
DEBIAN-CVE-2016-9180
perl-XML-Twig: The option to expandexternalents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting...