10144 matches found
CVE-2022-41967 Improper Restriction of XML External Entity Reference in Dragonfly
Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity XXE attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML SNAPSHOT versions are being resolved...
PT-2022-26190 · Dragonfly · Dragonfly
Name of the Vulnerable Software and Affected Versions: Dragonfly version 0.3.0-SNAPSHOT Description: The issue concerns a Java runtime dependency management library that does not configure DocumentBuilderFactory to prevent XML external entity XXE attacks. This can be avoided by not trying to...
Lego's Bricklink steps on cross site scripting blocks
If you build it, they will come. In Legos case, they built it and certain security flaws meant someone could have taken it all apart. PCMag reports that flaws in Legos Bricklink service meant that it was open to potential data leakage or even account hijacking. Those flaws, now addressed,...
XML External Entity (XXE) Injection
plexus-utils is vulnerable to XML External Entity XXE Injection. The vulnerability exists in the writeComment function of XmlWriterUtil.java because it does not properly check if the comment includes a --, resulting in the text contained in the command string being interpreted as XML, allowing an...
CVE-2022-4607
A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...
CVE-2022-4607
A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...
Xxe
A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...
CVE-2022-47514
An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...
Design/Logic Flaw
An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...
PT-2022-28067 · Unknown · Xml-Rpc.Net
Name of the Vulnerable Software and Affected Versions: XML-RPC.NET versions prior to 2.5.0 Description: An XML external entity XXE injection issue allows remote authenticated users to conduct server-side request forgery SSRF attacks. This can be demonstrated by a "pingback.aspx" POST request...
CVE-2022-47514
An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...
3DCityDB Web Feature Service Interface 代码问题漏洞
3DCityDB Web Feature Service Interface is an open source city database WFS interface library for 3D City Database. 3DCityDB Web Feature Service Interface before 5.3.0 version of the code problematic vulnerability , the vulnerability stems from some unknown processing problems , which will lead to...
PT-2022-27728 · Unknown · 3D City Database Ogc Web Feature Service
Name of the Vulnerable Software and Affected Versions: 3D City Database OGC Web Feature Service versions up to 5.2.1 Description: A vulnerability was found in the 3D City Database OGC Web Feature Service, which affects some unknown processing and leads to xml external entity reference. The...
CVE-2022-4607 3D City Database OGC Web Feature Service xml external entity reference
A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
PT-2022-17420 · Symantec · Symantec Identity Manager
Name of the Vulnerable Software and Affected Versions: Symantec Identity Manager version 14.4 Description: An authenticated user can perform XML eXternal Entity injection in the Management Console. This issue allows for potential data exposure or other malicious activities. Recommendations: For...
CVE-2022-25628
CVE-2022-25628 describes an XML External Entity (XXE) injection vulnerability in the Symantec Identity Manager 14.4 Management Console . An authenticated user can trigger XXE, with potential data exposure or other malicious activity as implied by the vulnerability class. The CVSS data from the en...
Symantec Identity Manager 代码问题漏洞
Symantec Identity Manager is an identity management system from Symantec Corporation. A security vulnerability exists in Symantec Identity Manager version 14.4, which originates from an authenticated user being able to perform XML external entity injection in the management console...