Magento XML-RPC XXE Arbitrary File Disclosure

The Magento application running on the remote web server is affected by an XML external entity injection XXE vulnerability due to improper parsing of XML data in the ZendXmlRpcServer class. A remote, unauthenticated attacker can exploit this vulnerability to view arbitrary files on the remote hos...

Satellite5: RPC API XML External Entities file disclosure

It was found that the RPC interface in Satellite would resolve external entities, allowing an attacker to conduct XML External Entity XXE attacks. A remote attacker could use this flaw to read files accessible to the user running the Satellite server, and potentially perform other more advanced X...

Moderate: Red Hat Security Advisory: spacewalk-java security update

Updated spacewalk packages that fix one security issue are now available for Red Hat Satellite 5.7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from t...

libxml-libxml-perl XML Processing Information Disclosure Vulnerability

libxml-libxml-perl is a library that provides an interface to parse and manipulate XML files. An error in the libxml-libxml-perl program's handling of the 'expandentities' parameter in the XML::LibXML module allows remote attackers to obtain information about sensitive data through the use of...

CVE-2015-3451

The clone function in XML::LibXML before 2.0119 does not properly set the expandentities option, which allows remote attackers to conduct XML external entity XXE attacks via crafted XML data to the 1 new or 2 loadxml function...

perl-xml-libxml: XML External Entity

Unpreserved unset options after a clone call e.g: in loadxml leads to not preserved expandentities. Therefore it leads to a XML-External-Entity Vulnerability...

Red Hat Drools XML External Entity Vulnerability

Red Hat Drools is the United States Red Hat Red Hat company's set of open source based on the RETE algorithm business rules management system BRMS solution. An XML external entity vulnerability exists in Red Hat Drools versions prior to 6.2.0. It allows remote attackers to read arbitrary files vi...

Xxe

XML external entity XXE vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file...

RESTeasy: External entities expanded by DocumentProvider

It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessibl...

jBPM: BPMN2 file processing XXE in Process Execution

It was discovered that the jBPM runtime performed expansion of external parameter entities while executing BPMN2 files. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity XXE...

RESTeasy: External entities expanded by DocumentProvider

It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessibl...

Huawei SEQ Analyst XXE Injection

Document Title: ============ Huawei SEQ Analyst - XML External Entity Injection XXE Release Date: =========== 15 Apr 2015 CVE-ID: ======= CVE-2015-2346 Product & Service Introduction: ======================= SEQ Analyst is a platform for business quality monitoring and management by individual us...

SAP NetWeaver 7.4 - XXE

Application: SAP NetWeaver Portal 7.4 Vendor URL: http://www.sap.com Bugs: XML eXternal Entity Reported: 16.04.2015 Vendor response: 17.04.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2168485 Authors: Roman Bezhan ERPScan VULNERABILITY INFORMATION Class: XML External Enti...

VMware Horizon View Multiple Vulnerabilities (VMSA-2015-0003) (VMSA-2015-0008) (POODLE)

The VMware Horizon View installed on the remote Windows host is version 5.x prior to 5.3.4 or version 6.x prior to 6.1. It is, therefore, affected by the following vulnerabilities : - A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0...

CVE-2015-1092

NSXMLParser in Foundation in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Xxe

NSXMLParser in Foundation in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2015-1092

NSXMLParser in Foundation in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Apple TV < 7.2 Multiple Vulnerabilities

According to its banner, the remote Apple TV device is a version prior to 7.2. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption vulnerabilities exist in WebKit due to improperly validated user-supplied input. A remote attacker, using a specially crafted...

Apple iOS NSXMLParser XML Processing Information Disclosure Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. An XML external entity reference vulnerability exists in Apple iOS NSXMLParser processing XML. The vulnerability allows attackers to obtain sensitive information...

java-batik: xml external entity injection

Batik offers several classes for SVG to PNG/JPG conversion, which suffer from a XML External Entity Injection due to the evaluation of external entities within the given SVG file. If an application offers the possibility to upload a SVG file an attacker can put in a malicious formed file and...