306 matches found
XXE vulnerability on agents in cccc
cccc 0.6 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the contents of the report file for the 'Publish CCCC Report' post-build step to have agent processes parse a crafted file that uses external entities for...
CVE-2022-45386
Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
Bruhn NewTech CBRN-Analysis 代码问题漏洞
Bruhn NewTech CBRN-Analysis is an advanced, off-the-shelf CBRN defense knowledge management software application from Bruhn NewTech. It provides knowledge management, hazard prediction, and warning and reporting W&R capabilities to support operational planning and execution. A security...
Trellix IPS Manager 代码问题漏洞
Trellix IPS Manager is a next-generation IPS for local and virtual networks from American FireEye Trellix. A security vulnerability exists in Trellix IPS Manager versions prior to 10.1 M8, which stems from the ability to import a saved XML configuration file through an external entity attack by a...
PT-2022-25741 · Jenkins · Jenkins Compuware Common Configuration Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Compuware Common Configuration Plugin versions 1.0.14 and earlier Description: The issue is related to the XML parser not being configured to prevent XML external entity XXE attacks. This allows attackers who can change the contents o...
The vulnerability of the DOMDeserializer component in the FasterXML jackson-databind library allows attackers to execute XXE attacks.
The vulnerability of the DOMDeserializer component in the FasterXML jackson-databind library is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a remote attacker to perform XXE attacks...
PT-2022-23616 · Ibm · Ibm Cognos Analytics
Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.1.7 through 11.2.1 Description: The issue is related to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume...
CVE-2022-36773
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233571...
CVE-2022-22489
IBM MQ 8.0, 9.0, 9.1, 9.2 LTS, and 9.1 and 9.2 CD are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339...
CVE-2022-2458
XML external entity injectionXXE is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML...
IBM DataPower Gateway 代码问题漏洞
IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B, and cloud workloads. The platform protects, integrates, and optimizes access across channe...
liquibase: Improper Restriction of XML External Entity
A flaw was found in Liquiibase's XMLChangeLogSAXParser function. It uses SAXParser with no FEATURESECUREPROCESSING set, which could possibly allow XML External Entity XXE attacks...
CVE-2022-32285
A vulnerability has been identified in Mendix SAML Module Mendix 7 compatible All versions V1.16.6, Mendix SAML Module Mendix 8 compatible All versions V2.2.2, Mendix SAML Module Mendix 9 compatible All versions V3.2.3. The affected module is vulnerable to XML External Entity XXE attacks due to...
CVE-2021-45981
NetScout nGeniusONE 6.3.2 allows an XML External Entity XXE attack...
CVE-2021-45981
NetScout nGeniusONE 6.3.2 allows an XML External Entity XXE attack...
CVE-2022-31261
An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker ca...
PT-2022-20428 · Jenkins · Jenkins Storable Configs Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Storable Configs Plugin versions 1.0 and earlier Description: The issue arises from the plugin not configuring its XML parser to prevent XML external entity XXE attacks. This allows attackers with Item/Configure permission to have...
CVE-2022-24449
Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document...
