XML External Entity (XXE) Injection

plexus-utils is vulnerable to XML External Entity XXE Injection. The vulnerability exists in the writeComment function of XmlWriterUtil.java because it does not properly check if the comment includes a --, resulting in the text contained in the command string being interpreted as XML, allowing an...

MAL-2022-1123 Malicious code in arpanrizki-panpan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6b640fbdbb106e7e039396ba5e56295d4388dcf0b3a2865daaaf226affc4253 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-4607

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

CVE-2022-4607

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

Xxe

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

CVE-2021-4249

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack...

Design/Logic Flaw

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack...

CVE-2022-47514

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

Design/Logic Flaw

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

PT-2022-28067 · Unknown · Xml-Rpc.Net

Name of the Vulnerable Software and Affected Versions: XML-RPC.NET versions prior to 2.5.0 Description: An XML external entity XXE injection issue allows remote authenticated users to conduct server-side request forgery SSRF attacks. This can be demonstrated by a "pingback.aspx" POST request...

CVE-2022-47514

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

CVE-2021-4249 xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack...

PT-2022-27728 · Unknown · 3D City Database Ogc Web Feature Service

Name of the Vulnerable Software and Affected Versions: 3D City Database OGC Web Feature Service versions up to 5.2.1 Description: A vulnerability was found in the 3D City Database OGC Web Feature Service, which affects some unknown processing and leads to xml external entity reference. The...

3DCityDB Web Feature Service Interface 代码问题漏洞

3DCityDB Web Feature Service Interface is an open source city database WFS interface library for 3D City Database. 3DCityDB Web Feature Service Interface before 5.3.0 version of the code problematic vulnerability , the vulnerability stems from some unknown processing problems , which will lead to...

PT-2022-11601

Name of the Vulnerable Software and Affected Versions xml-conduit versions prior to 1.9.1.0 Description A vulnerability was found in the DOCTYPE Entity Expansion Handler component of xml-conduit, affecting an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs. The manipulation...

snoyberg xml 安全漏洞

snoyberg xml is a package of various XML utilities for Haskell by the individual developer Michael Snoyman. A security vulnerability exists in snoyberg xml that stems from an infinite loop caused by some unknown functions in the xml-conduit/src/Text/XML/Stream/Parse.hs file of its component DOCTY...

CVE-2022-4607 3D City Database OGC Web Feature Service xml external entity reference

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

CVE-2022-25628

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...

CVE-2022-25628

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...

PT-2022-17420 · Symantec · Symantec Identity Manager

Name of the Vulnerable Software and Affected Versions: Symantec Identity Manager version 14.4 Description: An authenticated user can perform XML eXternal Entity injection in the Management Console. This issue allows for potential data exposure or other malicious activities. Recommendations: For...