10096 matches found
CVE-2020-12025
Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity XXE vulnerability, which may allow an attacker to view hostnames or other resources from the program...
Security Bulletin: IBM QRadar is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2020-4510)
Summary IBM QRadar is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2020-4510 DESCRIPTION: IBM QRadar is vulnerabl...
XML External Entity (XXE)
adal4j is vulnerable to XML External Entity XXE. The vulnerability exists because the external DTDs are not disabled by default in WSTrustResponse parse function in WSTrustResponse.java and getWsTrustEndpointFromMexResponse function in MexParser.java, allowing an attacker to submit a malicious XM...
Veeam ONE XML External Entity Reference Vulnerability
Veeam ONE is a suite of IT monitoring and reporting tools from Veeam Switzerland. An XML external entity reference vulnerability exists in the Veeam ONE ReporterImportLicense class, which can be exploited by an attacker with the help of a specially crafted document to cause information disclosure...
XML External Entity (XXE)
everrest-core is vulnerable to XML external entity XXE attacks. The external DTDs are not disabled by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server or read system files...
Rockwell Automation Logix Designer Studio 5000 Code Issue Vulnerability
Rockwell Automation Logix Designer Studio 5000 is the United States Rockwell Rockwell Automation company's set of logic controller programming software. A code issue vulnerability exists in Rockwell Automation Logix Designer Studio 5000 version 32.00, version 32.01, and version 32.02, which arise...
XML External Entity (XXE)
mapfish-print is vulnerable to XML External Entity XXE. The vulnerability exists as the disallow-doctype-decl feature was not set in the removeIndexReference method used in SLDParserPlugin...
Veeam ONE SSRSReport GetCustomElementText XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML External Entity XXE...
Veeam ONE Reporter_ImportLicense Page_Load XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ReporterImportLicense class. Due to the improper restriction of XML External Entit...
GHSA-VJV6-GQ77-3MJW XXE attack in Mapfish Print
Impact A user can do to an XML External Entity XXE attack with the provided SDL style. Patches Use version = 3.24 Workarounds No References https://cwe.mitre.org/data/definitions/611.html https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e For more...
Veeam ONE XML External Entity Processing vulnerabilities
Challenge XML External Entity Processing vulnerabilities in Veeam ONE Reporter make possible to read arbitrary files without authentication. Severity : critical CVSS v3 score : 7.5 Cause Veeam ONE Reporter uses XML files for importing and exporting report templates. A remote attacker may send...
Microsoft Windows mshta.exe 2019 - XML External Entity Injection
Exploit Title: Microsoft Windows mshta.exe 2019 - XML External Entity Injection Date: 2020-07-07 Exploit Author: hyp3rlinx Vendor homepage: https://www.microsofft.com/ CVE: N/A + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...
GHSA-9QCF-C26R-X5RF XML external entity injection in Terracotta Quartz Scheduler
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description...
CVE-2020-13692
A flaw was found in PostgreSQL JDBC in versions prior to 42.2.13. An XML External Entity XXE weakness was found in PostgreSQL JDBC. The highest threat from this vulnerability is to data confidentiality and system availability...
XML External Entity Injection in XStream
Multiple XML external entity XXE vulnerabilities in the 1 Dom4JDriver, 2 DomDriver, 3 JDomDriver, 4 JDom2Driver, 5 SjsxpDriver, 6 StandardStaxDriver, and 7 WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document...
CVE-2020-5602
Mitsubishi Electoric FA Engineering Software CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Software Development Kit EM Configurator Ver. 1.010L and earlier, GT Designer3 GOT2000 Ver. 1.221F and earlier, GX LogViewer Ver. 1.96A and earlie...
Xxe
Mitsubishi Electoric FA Engineering Software CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Software Development Kit EM Configurator Ver. 1.010L and earlier, GT Designer3 GOT2000 Ver. 1.221F and earlier, GX LogViewer Ver. 1.96A and earlie...
Mitsubishi Electric Factory Automation Engineering Software Products
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: Factory Automation Engineering Software Products Vulnerabilities: Improper Restriction of XML External Entity Reference and Uncontrolled Resource Consumption 2. RISK...
Rockwell Automation FactoryTalk Services Platform XML External Entity Injection Vulnerability
Rockwell Automation FactoryTalk Services Platform is a suite of services platforms from Rockwell Automation that provides routine services for applications such as diagnostic information, health monitoring and real-time data access. An XML external entity injection vulnerability exists in Rockwel...