Adobe ColdFusion Hotfix

Adobe today pushed out a hotfix to ColdFusion implementations, patching a vulnerability it had already patched nine days ago on the LiveCycle Data Services application framework. Today’s hotfix affects ColdFusion 11, update 5 and earlier, and ColdFusion 10, update 16 and earlier. Hotfixes, unlike...

DLA-302-1 zendframework - security update

Bulletin has no description...

Xxe

Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services LCDS 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containin...

CVE-2015-3269

CVE-2015-3269 is an XXE vulnerability in Apache Flex BlazeDS (used by flex-messaging-core.jar in LCDS) that allows a remote attacker to read arbitrary files via an AMF message containing an XML external entity declaration with an entity reference. Affected products include BlazeDS components in A...

CVE-2015-3269

Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services LCDS 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containin...

SAP NetWeaver Portal XML External Entity Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications.SAP NetWeaver Portal is a portal solution that provides single sign-on information for authentication via a Web browser. An XML external entity...

SAP Mobile Platform application import XML external entity vulnerability

SAP Mobile Platform SMP is a mobile application development platform from SAP. The platform is used to build packaged and customized development applications for any device. An XML external entity vulnerability exists in the application import feature of SMP version 2.3. A remote attacker can...

CVE-2015-6664

XML external entity XXE vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2152227...

Zend Framework XML External Entity Injection Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. An XML external entity injection vulnerability exists in ZF versions 2.4.2 and earlier and 1.12.13 and earlier. An...

Apple iOS Office Viewer Sensitive Information Disclosure Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in Apple iOS Office Viewer that allows remote users to construct special XML files and trick apps into parsing them, which can trigger XML external entity processing to...

DSA-3340-1 zendframework - security update

Bulletin has no description...

Adobe LiveCycle Data Services Hotfix

Adobe is today expected to push a hotfix through to implementations of its LiveCycle Data Services application framework. The company said the vulnerability, CVE-2015-3269, affects versions 4.7, 4.6.2, 4.5 and 3.0.x on Windows, Macintosh and UNIX systems. Adobe is not aware of public exploits of...

CVE-2015-3784

Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2015-3784

CVE-2015-3784 affects Apple’s Office Viewer in iOS versions before 8.4.1 and OS X versions before 10.10.5. The issue arises from an XML External Entity (XXE) vulnerability where an external entity declaration, combined with an entity reference, enables a remote attacker to read arbitrary files vi...

Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection

Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection ============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161 ============================================= I. VULNERABILITY -------------------------...

Zend Framework 2.4.2 / 1.12.13 XXE Injection

============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161 ============================================= I. VULNERABILITY ------------------------- Zend Framework From http://framework.zend.com/about/ website:...

Red Hat JBoss BPM Suite dashbuilder XML External Entity Vulnerability

Red Hat JBoss BPM Suite is a business process management platform from Red Hat, Inc. that brings together all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation and business process monitoring. An XML external entity vulnerability exists in t...

CVE-2015-1818

XML external entity XXE vulnerability in the dashbuilder import facility DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery SSRF attacks, and have other...

CVE-2015-1818

CVE-2015-1818 affects Red Hat JBoss BPM Suite's dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) where XML External Entity (XXE) processing was not disabled, enabling read of arbitrary files and SSRF via crafted XML. Impact is partial confidentiality/...

Camel: XXE via XPath expression evaluation

It was found that Apache Camel performed XML External Entity XXE expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and...