Xxe

An XML External Entity injection XXE vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrar...

CVE-2018-18980

An XML External Entity injection XXE vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrar...

Zoho ManageEngine Network Configuration Manager and OpManager XML External Entity Injection Vulnerability

ZOHO ManageEngine Network Configuration Manager and OpManager are both products of ZOHO Inc. ZOHO ManageEngine Network Configuration Manager is a suite of network configuration management, network change and configuration management NCCM software for configuring switches, routers, firewalls and...

IBM Rational Engineering Lifecycle Manager XML External Entity Injection Vulnerability (CNVD-2018-24366)

IBM Rational Engineering Lifecycle Manager is a suite of engineering lifecycle management software from IBM in the United States. A security vulnerability exists in IBM Rational Engineering Lifecycle Manager. An attacker could exploit the vulnerability to disclose sensitive information or consume...

Cisco WebEx Meetings Server XML External Entity Injection Vulnerability

Cisco WebEx Meetings Server is a versatile videoconferencing solution from Cisco USA. Cisco WebEx Meetings Server suffers from an XML external entity injection vulnerability, which could allow a remote, unauthenticated attacker to cause confidential data disclosure, denial of service, server-side...

Fr. Sauter AG CASE Suite XML External Entity Injection Vulnerability

Fr. Sauter AG CASE Suite is a software development kit for building automation systems from Fr. Sauter AG, Switzerland. An XML external entity injection vulnerability exists in Fr. Sauter AG CASE Suite version 3.10 and earlier. A remote attacker could exploit this vulnerability to cause a file...

CVE-2018-1846

IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID:...

CVE-2018-1835

IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150514...

CVE-2018-1846

IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID:...

Xxe

IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID:...

CVE-2018-1835

IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150514...

CVE-2018-1846

IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID:...

CVE-2018-17912

An XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter entities, which may allow remote file disclosure...

XML External Entity (XXE)

granite-client and granite-server is vulnerable to a XML external entity XXE attack. The library does not disable document type declarations, allowing a malicious user to pass an XML file to it conduct an XXE attack...

Arcserve Unified Data Protection XML External Entity Injection Vulnerability

Arcserve Unified Data Protection UDP is a set of unified data protection solutions from Arcserve, Inc. in the United States. The solution provides backup and recovery of all virtual and physical environments, global deduplication, and more. An XML external entity injection vulnerability exists in...

Security Bulletin: Security vulnerability affects Rational Engineering Lifecycle Manager

Summary Rational Engineering Lifecycle Manager is affected by a potential security vulnerability Vulnerability Details CVEID: CVE-2018-1846 DESCRIPTION: IBM RELM is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerabilit...

The vulnerability of the xmlStringLenDecodeEntities function (parser.c) in the libxml2 library allows a attacker to cause a service failure or disclose protected information.

The vulnerability of the xmlStringLenDecodeEntities function in the parser.c file of the libxml2 library is due to insufficient restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to cause service failures or disclose protected informati...

CVE-2018-18659

An issue was discovered in Arcserve Unified Data Protection UDP through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue...

Apache OFBiz 16.11.04 - XML External Entity Injection

Exploit Title: Apache OFBiz 16.11.04 - XML External Entity Injection Date: 2018-10-15 Exploit Author: Jamie Parfet Vendor Homepage: https://ofbiz.apache.org/ Software Link: https://archive.apache.org/dist/ofbiz/ Version: xXx xXx """ if lensys.argv = 1: print' Apache OFBiz 16.11.04 XXE' print' Use...

Apache OFBiz 16.11.04 XML Injection

Exploit Title: Apache OFBiz 16.11.04 - XML External Entity Injection Date: 2018-10-15 Exploit Author: Jamie Parfet Vendor Homepage: https://ofbiz.apache.org/ Software Link: https://archive.apache.org/dist/ofbiz/ Version: xXx xXx """ if lensys.argv = 1: print' Apache OFBiz 16.11.04 XXE' print' Use...