18881 matches found
CVE-2022-25628
CVE-2022-25628 describes an XML External Entity (XXE) injection vulnerability in the Symantec Identity Manager 14.4 Management Console . An authenticated user can trigger XXE, with potential data exposure or other malicious activity as implied by the vulnerability class. The CVSS data from the en...
Symantec Identity Manager 代码问题漏洞
Symantec Identity Manager is an identity management system from Symantec Corporation. A security vulnerability exists in Symantec Identity Manager version 14.4, which originates from an authenticated user being able to perform XML external entity injection in the management console...
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
Malicious code in mrpackage1-npm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd54e93c66de2678ac942d0f8be89b517fa2bb343e1755139c6702f4d29ca809 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6488 Malicious code in test-pls (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e944bd9669b6670b936f57b7f11202f8a8c0bdf172864bc6e95f9ff567a97ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Adobe Experience Manager 6.5.0.0 < 6.5.15.0 Multiple Vulnerabilities (APSB22-59)
The version of Adobe Experience Manager installed on the remote host is prior to 6.5.15.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB22-59 advisory. - Adobe Experience Manager version 6.5.14 and earlier is affected by a reflected Cross-Site Scripting XSS...
pki-core: access to external entities when parsing XML can lead to XXE
A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...
Security Bulletin: IBM InfoSphere Information Server is vulnerable to an XML External Entity Injection (CVE-2022-40747)
Summary IBM InfoSphere Information Server is vulnerable to an XML External Entity Injection XXE Vulnerability Details CVEID:CVE-2022-40747 DESCRIPTION: IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker...
Security Bulletin: Apache POI up to 4.1.0 allows an attacker while converting user-provided document to XML
Summary In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker. Vulnerability Details CVEID:CVE-2019-12415 DESCRIPTION: Apache POI could allow a remote attacker to obtain sensitive...
Jenkins Plot Plugin XML External Entity Reference vulnerability
Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of secret...
GHSA-WGPP-G6V9-7HXP Jenkins Plot Plugin XML External Entity Reference vulnerability
Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of secret...
MAL-2022-6038 Malicious code in setup-gamma (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deba7e063fe3b4609326e55cea28db816c7049297f8cef8b23d8c2d7589f69f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5450 Malicious code in preply-riddle-online-status (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6488e7d6017789ffad8b23dd037223fc87627c59ae8854b6b2517397e22e275c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Amazon Linux 2022 : libxml2 (ALAS2022-2022-258)
The version of libxml2 installed on the remote host is prior to 2.10.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-258 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE...
The vulnerability of the dynamic data management framework Apache Calcite, related to incorrect restrictions on XML links to external objects, allows attackers to perform XXE attacks.
The vulnerability of the Apache Calcite dynamic data management framework is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks using specially created XML code...
CLSA-2022-1670523520 libxml2: Fix of 2 CVEs
CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...
CLSA-2022-1670523403 libxml2: Fix of 2 CVEs
CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...
CVE-2022-46827
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible...