XML External Entity (XXE)

hapi-fhir-utilities is vulnerable to XML external entities XXE. An attacker is able to provide malicious XML input containing a reference to an external entity and retrieve system files. The vulnerability exists as the library does not disable external DTDs and doctype declarations by default...

PT-2020-15549 · Jenkins · Jenkins Visualworks Store Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Visualworks Store Plugin versions 1.1.3 and earlier Description: The issue allows attackers with the ability to control the output of a script that runs Visualworks with StoreCI, or able to control an agent process, to have Jenkins...

PT-2020-4651 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: The issue is related to improper handling of XML External Entity XXE entries when parsing certain XML files in the web UI of Cisco SD-WAN vManage Software. This could...

PT-2020-4652 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: The issue is related to improper handling of XML External Entity XXE entries when parsing certain XML files. An attacker could exploit this by persuading a user to...

IBM WebSphere Application Server 6.1.0.x <= 6.1.0.47 / 7.0.0.x < 7.0.0.43 / 8.0.0.x < 8.0.0.13 / 8.5.x < 8.5.5.10 XXE (CVE-2015-0254)

The IBM WebSphere Application Server running on the remote host is version 6.1.x through 6.1.0.47, 7.0.0.x prior to 7.0.0.43, 8.0.0.x prior to 8.0.0.13, or 8.5.0.x prior to 8.5.5.10. It is, therefore, affected by an XML external entity injection vulnerability in the Apache Standard Taglibs...

jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity...

Pulse Secure Pulse Connect Secure and Pulse Policy Secure Cross-Site Request Forgery Vulnerabilities

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse and Pulse Policy Secure are both products of Pulse Secure, Inc.Pulse Connect Secure is an SSL VPN solution. Pulse Connect Secure is an SSL VPN solution. Pulse Policy Secure is a network access control solution. A...

CVE-2020-15352

An XML external entity XXE vulnerability in Pulse Connect Secure PCS before 9.1R9 and Pulse Policy Secure PPS before 9.1R9 allows remote authenticated admins to conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

Server side request forgery (ssrf)

An XML external entity XXE vulnerability in Pulse Connect Secure PCS before 9.1R9 and Pulse Policy Secure PPS before 9.1R9 allows remote authenticated admins to conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CVE-2020-15352

An XML external entity XXE vulnerability in Pulse Connect Secure PCS before 9.1R9 and Pulse Policy Secure PPS before 9.1R9 allows remote authenticated admins to conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

PT-2020-14384 · Pulse · Pulse Connect Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R9 Pulse Policy Secure versions prior to 9.1R9 Description: The issue allows remote authenticated admins to conduct server-side request forgery attacks via a crafted DTD in an XML request. This is due...

CVE-2020-25186

An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file disclosure...

jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity...

Important: Red Hat Security Advisory: rh-maven35-jackson-databind security update

An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

WECON LeviStudioU XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of WECON LeviStudioU. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-6366

SAP NetWeaver Compare Systems versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service...

Authenticated XML External Entity Processing

Impact Authenticated XML External Entity Processing Patches We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions...

SAP 3D Visual Enterprise Viewer SVG File XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of SAP 3D Visual Enterprise Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...