317 matches found
PT-2024-18059
Name of the Vulnerable Software and Affected Versions LangChain affected versions not specified Description The issue concerns the XMLOutputParser in LangChain, which utilizes the etree module from the XML parser in the standard Python library. This library has some XML vulnerabilities, making it...
SUSE CVE-2024-23525
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the noxxe option of XML::Twig...
Vulnerability fixed in Ivanti Connect Secure and Policy Secure Gateways
Ivanti has fixed a vulnerability in Ivanti Connect Secure, Policy Secure and ZTA gateway. The vulnerability allows a malicious party to use an XML External Entity attack to gain access to system resources without having the required authentication. The vulnerability was discovered during the...
CVE-2023-52239
The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport...
Magic xpi Integration Platform Security Vulnerability
Magic xpi Integration Platform is an integration platform from Magic designed to simplify integration between enterprise applications and systems. A security vulnerability exists in Magic xpi Integration Platform version 4.13.4. An attacker exploited the vulnerability to perform an xml external...
Spreadsheet::ParseXLSX Security Vulnerability
Spreadsheet::ParseXLSX is an XLSX file parser. A security vulnerability exists in Spreadsheet::ParseXLSX versions prior to 0.30 that stems from allowing XML External Entity References XXE attacks...
CVE-2023-49656
Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
PT-2023-31281 · Jenkins · Jenkins Matlab Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins MATLAB Plugin versions 2.11.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to have Jenkins parse an XML file from the Jenkins controller file system. The plugin determines whether a...
Improper restriction of XML external entity references (XXE) in FD Application
Overview FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references XXE CWE-611. Toyama Taku and Sakaki Ryutaro of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...
CVE-2023-40239
Certain Lexmark devices such as CS310 before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80..P246, i.e., '' indicates that the full version specification varies across product model family, but firmware level P246 or higher is required to...
CVE-2023-37497
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks XXE against the backend service...
CVE-2023-30951
The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack XXE...
CVE-2023-30951 CVE-2023-30951
The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack XXE...
CVE-2023-37942
Jenkins External Monitor Job Type Plugin 206.v9a94ff0b4a10 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
Jenkins Plugin External Monitor Job Type 代码问题漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
Schneider Electric OPC Factory Server 代码问题漏洞
Schneider Electric OPC Factory Server is a software application from the French company Schneider Electric Schneider Electric. An XML external entity injection vulnerability exists in Schneider Electric OPC Factory Server, which stems from an improper restriction on XML external entity references...
CVE-2023-29443
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint...
Important: pki-core
Issue Overview: Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. CVE-2022-2414 Affected Packages: pki-core Note:...