690 matches found
CVE-2024-34102
CVE-2024-34102 is an XXE vulnerability in Adobe Commerce/Magento Open Source that allows remote code execution. The issue affects Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier, via improper restriction of XML external entity references. Exploitation can occur without use...
CVE-2024-34102 XXE can expose crypt key and other secrets granting full admin access
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that...
CVE-2024-34102 XXE can expose crypt key and other secrets granting full admin access
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that...
CVE-2024-34102 XXE can expose crypt key and other secrets granting full admin access
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that...
CVE-2024-30043: Improper Restriction of XML External Entity Reference
Microsoft SharePoint Server Information Disclosure Vulnerability...
RHEL 7 : apache-ivy (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - apache-ivy: Directory Traversal CVE-2022-37865 - Improper Restriction of XML External Entity Reference, X...
CVE-2024-34345 @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1...
CVE-2023-51605: Improper Restriction of XML External Entity Reference
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this...
CVE-2024-34392 libxmljs namespaces type confusion RCE
libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces function which invokes wrapxmlNodensDefget on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution...
CVE-2024-21082: Improper Restriction of XML External Entity Reference
Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: XML Services. Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher...
CVE-2024-21048: Improper Restriction of XML External Entity Reference
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: XML input. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web...
CVE-2024-31139: Improper Restriction of XML External Entity Reference
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector...
CVE-2024-2826
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been...
CVE-2024-2826 lakernote EasyAdmin saveReportFile xml external entity reference
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been...
CVE-2024-2826 lakernote EasyAdmin saveReportFile xml external entity reference
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been...
CVE-2024-2826: Improper Restriction of XML External Entity Reference
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been...
CVE-2023-50168: Improper Restriction of XML External Entity Reference
Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation...
CVE-2024-24743: Improper Restriction of XML External Entity Reference
SAP NetWeaver AS Java CAF - Guided Procedures - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so...
CVE-2024-1167 SEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity Reference
When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur...