10096 matches found
CVE-2024-3969 XML External Entity injection vulnerability in iManager
XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload...
PT-2024-28628 · Opentext · Opentext Imanager
Name of the Vulnerable Software and Affected Versions: OpenText iManager version 3.2.6.0200 Description: The issue is related to an XML External Entity injection, which could lead to remote code execution by parsing untrusted XML payload. Recommendations: For OpenText iManager version 3.2.6.0200,...
RHEL 8 : python27:2.7 (RHSA-2024:2987)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2987 advisory. Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic...
XML External Entity (XXE) Injection
neos/flow is vulnerable to XML External Entity XXE. The vulnerability is due to the MediaTypeConverter improperly handling XML input, which could be exploited to conduct XXE attacks...
python: XML External Entity in XML processing plistlib module
A flaw was found in Python caused by improper handling of XML external entity XXE declarations by the plistlib module. By using a specially crafted XML content, an attacker could obtain sensitive information by disclosing files specified by parsing URI, and may cause denial of service by resource...
PT-2024-12890 · Undefined · Undefined
ChatGPT помог заработать $28 000 на 0-day. Базовый XXE-пейлоад выглядит как-то так Можно залить файл с таким содержимым на сервер и, если у либы, которая его распарсит, включена поддержка внешних сущностей, на выходе мы получим содержимое /etc/passwd. Это касается библиотек, но не браузеров. Если...
GHSA-5VV7-J593-MGJC Neos Flow Arbitrary file upload and XML External Entity processing
It has been discovered that Flow 3.0.0 allows arbitrary file uploads, inlcuding server-side scripts, posing the risk of attacks. If those scripts are executed by the server when accessed through their public URL, anything not blocked through other means is possible information disclosure, placeme...
Neos Flow Arbitrary file upload and XML External Entity processing
It has been discovered that Flow 3.0.0 allows arbitrary file uploads, inlcuding server-side scripts, posing the risk of attacks. If those scripts are executed by the server when accessed through their public URL, anything not blocked through other means is possible information disclosure, placeme...
Security Bulletin: Security Vulnerabilities in Liberty affect IBM Voice Gateway
Summary Security Vulnerabilities in Liberty affect IBM Voice Gateway Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to an XML External Entity Injection XXE atta...
EulerOS Virtualization 3.0.6.6 : python (EulerOS-SA-2024-1663)
According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A use-after-free exists in Python through 3.9 via heappushpop in heapq. CVE-2022-48560 - An XML External Entity XXE issue was...
EulerOS Virtualization 3.0.6.0 : python3 (EulerOS-SA-2024-1698)
According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declaratio...
EulerOS Virtualization 3.0.6.0 : python2 (EulerOS-SA-2024-1697)
According to the versions of the python2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A use-after-free exists in Python through 3.9 via heappushpop in heapq. CVE-2022-48560 - An XML External Entity XXE issue was...
Huawei EulerOS: Security Advisory for python2 (EulerOS-SA-2024-1697)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for python (EulerOS-SA-2024-1663)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-4357
An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 10.0.24.305 or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing...
CVE-2024-4357
An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 10.0.24.305 or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing...
CVE-2024-3486
XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution...
CVE-2024-3486
XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution...
CVE-2024-4357 XML External Entity Processing Information Disclosure
An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 10.0.24.305 or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing...
CVE-2024-4357
Progress Telerik Report Server (versions 10.0.24.305 and earlier, i.e., 2024 Q1) suffers an XML External Entity Processing (XXE) information-disclosure vulnerability in the ValidateMetadaUri path. A low-privilege attacker could read system files; an authenticated context is required but may be by...