CVE-2017-1219

CVE-2017-1219 describes an XML External Entity (XXE) injection vulnerability in IBM Tivoli Endpoint Manager (now IBM BigFix Platform). The issue arises while processing XML data, allowing a remote attacker to disclose sensitive information or exhaust memory resources. Connected sources consistent...

CVE-2017-1219

IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 123859...

Vulnerabilities in ProcessMaker, WebFOCUS, and OpenFire Identified and Patched

Today, Talos is disclosing several vulnerabilities that have been identified by Portcullis in various software products. All four vulnerabilities have been responsibly disclosed to each respective developer in order ensure they are addressed. In order better protect our customers, Talos has also...

Multiple Vulnerabilities in Hitachi Automation Director and Hitachi Infrastructure Analytics Advisor

Overview Multiple vulnerabilities have been found in Hitachi Automation Director and Hitachi Infrastructure Analytics Advisor. Impact They may conduct the attacks listed below. Cross-site Scripting XXE XML External Entity Open Redirect Solution Please refer to the 'Vendor Information' section for...

XML External Entity (XXE) Processing

Apache Sling XSS protection is vulnerable to XML External Entity XXE processing attacks. The library uses an insecure SAX parser to validate strings, allowing a malicious user to read sensitive data in the filesystem, conduct port-scanning behind the firewall or execute arbitrary code...

CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

DEBIAN-CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

CVE-2017-1000021

LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents...

Xxe

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

UBUNTU-CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

SAP Business Objects Titan XML External Entity Injection Vulnerability

SAP BusinessObjects Germany SAP SAP company developed a provide a variety of business intelligence software, information management software, enterprise performance management solutions, regulatory, risk and compliance solutions. An XML external entity injection vulnerability exists in SAP Busine...

Apache OpenMeetings XML External Entity Injection Vulnerability

Apache OpenMeetings is audio and video conferencing software. Apache OpenMeetings suffers from an XML external entity injection vulnerability in its implementation, which could be exploited by a remote attacker to submit a specially crafted XML request, obtain sensitive information, or conduct a...

CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

CVE-2017-1000061

XML Security Library (xmlsec) 1.2.23 and earlier is vulnerable to XML External Entity Expansion when parsing crafted input, enabling information disclosure or denial of service. The root cause is improper handling of external entities in the library’s XML processing. Affected environments are doc...

Microsoft Windows System Information Console Information Disclosure Vulnerability

Microsoft windows is a popular operating system. Microsoft System Information Console does not properly parse XML inputs that contain references to external entities, allowing an attacker to exploit the vulnerability by submitting a special XML request, obtaining sensitive information, and...

Microsoft Windows XML External Entity Local Information Disclosure Vulnerability

Microsoft windows is a popular operating system. Microsoft Windows Performance Monitor does not properly parse XML inputs that contain references to external entities, allowing an attacker to exploit the vulnerability by submitting a special XML request to obtain sensitive information and read...

Microsoft Windows Performance Monitor Information Disclosure Vulnerability (KB4025397)

This host is missing an important security update according to Microsoft KB4025397 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

CVE-2017-8557

Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability improperly parses XML input containing a...

Information disclosure

Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability improperly parses XML input containing a...