10094 matches found
XML External Entity (XXE) Through An XSLT Extension
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity XXE attacks via a crafted XSLT extension in a 1 or 2 JSTL XML tag...
XML External Entity (XXE)
spacewalk-java is vulnerable to XML External Entity XXE attacks. The vulnerability exists as the RPC interface in Spacewalk and Red Hat Network RHN Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors...
XML External Entity (XXE)
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain Tomcat internals information by leveraging the presence of an untrusted web application with a context.xml, web.xml, .jspx, .tagx, or .tld XML document containing an external entity declaration in...
XML External Entity (XXE)
postgresql is vulnerable to XML External Entity XXE attacks. The vulnerability exists as the libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote...
XML External Entity (XXE)
picketlink-federation is vulnerable to XML External Entity XXE attacks. The vulnerability exists as the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references...
XML External Entity (XXE)
librsvg2 is vulnerable to XML External Entity XXE attacks. The vulnerability exists as GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entit...
XML External Entity (XXE) To Read Files
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...
Security Bulletin: IBM Security Identity Manager is affected by multiple vulnerabilities (CVE-2018-1956, CVE-2018-1969, CVE-2018-1967, CVE-2018-2019)
Summary IBM Security Identity Manager ISIM has addressed the following vulnerabilities that can allow attackers to compromise user accounts via weak passwords, uploading or transferring dangerous files types, cross-site scripting, or information disclosure and denial of service attacks...
PT-2019-8297 · Shopware · Shopware
Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.3.4 Description: The issue is related to a PHP Object Instantiation problem. It can be triggered via the sort parameter to the loadPreviewAction method of the Shopware Controllers Backend ProductStream controller...
The vulnerability of Microsoft SQL Server Management Studio, related to errors in restricting XML references to external objects (XXE), allows attackers to disclose sensitive information.
The vulnerability of Microsoft SQL Server Management Studio is related to errors in restricting XML references to external objects XXE. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information using a specially crafted file...
The vulnerability of the Microsoft SQL Server Management Studio database management system, related to errors in XML references to external objects (XXE), allows for the disclosure of sensitive information.
The vulnerability of the Microsoft SQL Server Management Studio database management system is related to errors in XML references to external objects XXE. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information using a specially crafted file...
Schneider Electric IIoT Monitor AccountMgmt forgotPwd XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the forgotPwd method of the AccountMgmt servlet. Due to the improp...
Schneider Electric IIoT Monitor AccountMgmt Login XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the Login method of the AccountMgmt servlet. Due to the improper...
XML External Entity Injection (XXE)
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...
Traccar Server <= 4.2 XXE Vulnerability
Traccar is prone to an XXE vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112483...
XML External Entity Injection (XXE)
Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...
Apache Tomcat < 8.0.0-RC10 Multiple Vulnerabilities
According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 8.0.0-RC10. It is, therefore, affected by multiple vulnerabilities: - The fix for CVE-2012-3544 was not complete and limits are not properly applied to chunk extensions and whitespac...
Microsoft Visual Studio wpa Protocol XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Visual Studio. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...
