Xxe

LogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity XXE attacks via unspecified vectors...

Security Bulletin: IBM FileNet Content Manager component FileNet Deployment Manager security vulnerability

Summary FileNet Deployment Manager external DTD security vulnerability. Vulnerability Details CVEID: CVE-2018-1844 DESCRIPTION: IBM Case Manager is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose...

CVE-2019-5748

In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks...

BlogEngine 3.3 - XML External Entity Injection

BlogEngine 3.3 - XML External Entity Injection XML External Entity Injection Vulnerability in BlogEngine 3.3 Information -------------------- Advisory by Netsparker Name: XML External Entity Injection Vulnerability in BlogEngine 3.3 Affected Software: BlogEngine Affected Versions: 3.3 Homepage:...

BlogEngine 3.3 - XML External Entity Injection Vulnerability

Exploit for windows platform in category web applications XML External Entity Injection Vulnerability in BlogEngine 3.3 Information -------------------- Advisory by Netsparker Name: XML External Entity Injection Vulnerability in BlogEngine 3.3 Affected Software: BlogEngine Affected Versions: 3.3...

PHP 5.6.x < 5.6.6 Multiple Vulnerabilities (GHOST)

According to its banner, the version of PHP 5.6.x installed on the remote host is prior to 5.6.6. It is, therefore, affected by multiple vulnerabilities : - A heap-based buffer overflow flaw in the GNU C Library glibc due to improperly validating user-supplied input in the glibc functions...

BlogEngine 3.3 XML External Entity Injection

XML External Entity Injection Vulnerability in BlogEngine 3.3 Information -------------------- Advisory by Netsparker Name: XML External Entity Injection Vulnerability in BlogEngine 3.3 Affected Software: BlogEngine Affected Versions: 3.3 Homepage: https://blogengine.io/ Vulnerability: XML Extern...

BlogEngine 3.3 - XML External Entity Injection

XML External Entity Injection Vulnerability in BlogEngine 3.3 Information -------------------- Advisory by Netsparker Name: XML External Entity Injection Vulnerability in BlogEngine 3.3 Affected Software: BlogEngine Affected Versions: 3.3 Homepage: https://blogengine.io/ Vulnerability: XML Extern...

Apache Karaf XML External Entity Injection Vulnerability

Apache Karaf is the United States Apache Apache Software Foundation for the deployment of applications and components of a lightweight OSGi Java Dynamic Modular System container. An XML external entity injection vulnerability exists in Apache Karaf versions prior to 4.1.7 and prior to 4.2.2. An...

GHSA-92WJ-X78C-M4FX XML External Entity Reference in Apache Karaf

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

GHSA-Q485-J897-QC27 XML External Entity Reference in mchange:c3p0

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

CVE-2018-11788

A flaw was found in the Apache Karaf XMLInputFactory, where it does not prevent External Entity Processing XXE. This is a potential security risk as an attacker could inject external XML entities to access sensitive information or conduct further attacks...

XML External Entity Reference in c3p0:c3p0

c3p0 allows XXE during initialization...

MGASA-2019-0002 Updated xmlrpc packages fix security vulnerabilities

XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery SSRF attacks via a crafted DTD CVE-2016-5002. A flaw was discovered in the Apache XML-RPC ws-xmlrpc library that...

GHSA-X2W5-5M2G-7H5M XML External Entity Reference (XXE) in jackson-databind

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity XXE attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization...

Security Bulletin: IBM MQ Appliance is affected by a XML External Entity Injection (XXE) vulnerability (CVE-2018-1669)

Summary IBM MQ Appliance has addressed the following XML External Entity Injection XXE vulnerability. Vulnerability Details CVEID: CVE-2018-1669 DESCRIPTION: IBM WebSphere DataPower Appliances is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker...

Zoho ManageEngine ADSelfService Plus XML External Entity Injection Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. An XML external entity injection vulnerability exists in ZOHO ManageEngine ADSelfService Plus prior to 5.x build 5701, which can be exploited by an attacker to conduct XXE attacks via an uploaded...

FasterXML jackson-databind XXE vulnerability

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . Jackson-databind is one of the components with data binding capabilities . A XXE vulnerability exists in version 2.x of FasterXML Jackson-databind prior to 2.9.7, which can be exploited by a remote attacker to perform...

PhpSpreadsheet XML External Entity Injection (CVE-2018-19277)

An XML external entity injection vulnerability exists in PhpSpreadsheet library. The vulnerability is due to a failure to properly handle external entity references in XML files. A successful exploitation of this vulnerability could result in the disclosure of file contents from the target system...