CVE-2019-1010268

Ladon since 0.6.1 since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059 is affected by: XML External Entity XXE. The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance:...

Microsoft Compiled HTML Help / Uncompiled .chm File XML External Entity Vulnerability

Microsoft Compiled HTML Help is Microsoft's proprietary online help formatting tool, consisting of a set of HTML pages, an index, and other navigation tools. An XML external entity injection vulnerability exists in the Microsoft Compiled HTML Help Uncompiled.chm file, which arises when the progra...

Microsoft Compiled HTML Help / Uncompiled .chm File XML External Entity Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-HTML-HELP-UNCOMPILED-CHM-FILE-XML-EXTERNAL-ENTITY-INJECTION.txt + ISR: ApparitionSec Vendor www.microsoft.com Product Microsoft Compiled HTML Help "hh.exe"...

Microsoft Compiled HTML Help / Uncompiled .chm File - XML External Entity Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-HTML-HELP-UNCOMPILED-CHM-FILE-XML-EXTERNAL-ENTITY-INJECTION.txt + ISR: ApparitionSec Vendor www.microsoft.com Product Microsoft Compiled HTML Help "hh.exe"...

SAP HANA Extended Application Services External Entity Injection Vulnerability

SAP HANA is a high-performance real-time data analytics platform from SAP. The platform provides data query functions to support users to query real-time business data query and analysis.Extended Application Services is an application server, Web server and SAP HANA System within the Web...

CVE-2018-17152

Intersystems Cache 2017.2.2.865.0 allows XXE...

XML External Entity (XXE)

Odata4j is vulnerable to XML External Entity because the library does not disable reading external entities in StaxXMLInputFactory2. A remote attacker could submit a request containing an external XML entity that, when resolved, allows that attacker to read files on the application server with us...

SAP BusinessObjects Business IntelligenceXML External Entity Injection Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of bookstore intelligence software and enterprise performance solutions from Germany's SAP. The product features report generation, analytics and data visualization. A security vulnerability exists in SAP BusinessObjects Business...

Microsoft Windows Event Viewer XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within Event...

CVE-2019-12924

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection XXE attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all...

XML External Entity (XXE)

apache syncope is vulnerable to XML external entity attacks XXE. An attacker is able to read and write arbitrary files and execute arbitrary code using malicious DTDs in the workflow definition entitlements...

XML External Entity (XXE)

umbraco cms is vulnerable to XML external entity XXE attacks. Lack of validation and permitting of external DTDs allow attackers to obtain confidential information via an SSRF from the XXE attack...

XML External Entity (XXE)

Jenkins Token Macro Plugin is vulnerable to XML external entity attacks. A remote, unauthenticated attacker could control the content of the input file for the "XML" macro to have Jenkins resolve external entities and exploit of the flawed XML Data Handler component resulting in the extraction of...

GHSA-C9JJ-3WVG-Q65H Vulnerability that affects org.apache.pdfbox:pdfbox

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted XFDF...

Improper Restriction of XML External Entity Reference in DiffPlug Spotless

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

RHEL 7 : OpenShift Container Platform 4.1 jenkins-2-plugins (RHSA-2019:1636)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1636 advisory. This advisory contains the jenkins-2-plugins RPM packages for Red Hat OpenShift Container Platform 4.1.4. See the following advisory for the...

Debian DLA-1844-1 : lemonldap-ng security update

It was discovered that there was a XML external entity vulnerability in the lemonldap-ng single-sign on system. This may have led to the disclosure of confidential data, denial of service, server side request forgery, port scanning, etc. For Debian 8 'Jessie', this issue has been fixed in...

[SECURITY] [DLA 1844-1] lemonldap-ng security update

Package : lemonldap-ng Version : 1.3.3-1+deb8u2 CVE ID : CVE-2019-13031 Debian Bug : 931117 It was discovered that there was a XML external entity vulnerability in the lemonldap-ng single-sign on system. This may have led to the disclosure of confidential data, denial of service, server side...

jenkins-plugin-token-macro: XML External Entity processing the ${XML} macro

An XML external entities XXE vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side...

DEBIAN-CVE-2019-13031

LemonLDAP::NG before 1.9.20 has an XML External Entity XXE issue when submitting a notification to the notification server. By default, the notification server is not enabled and has a "deny all" rule...