109 matches found
PT-2020-21068
Name of the Vulnerable Software and Affected Versions html-pdf-chrome versions prior to 0.6.1 Description The issue allows attackers to perform Server-Side Request Forgery SSRF by executing HTTP requests if the parsed HTML contains external references to resources. This enables access to resource...
The vulnerability in the implementation of the XML::Twig Perl module for processing XML documents in a tree-like mode allows a attacker to cause a service failure or gain unauthorized access to protected information.
The vulnerability of the expandexternalents configuration implementation in the Perl module for processing XML documents in a tree-like mode, implemented via XML::Twig, is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow an attack...
The vulnerability relates to the XSSFExportToXml Java library for reading and writing MS Office documents using Apache POI. It allows an attacker to gain unauthorized access to read these files.
The vulnerability in the XSSFExportToXml Java library for reading and writing MS Office documents using Apache POI is related to deficiencies in the restriction on XML references to external objects. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read the fil...
The vulnerability of the SOAP API interface of the Cisco Data Center Network Manager system allows a attacker to disclose sensitive information.
The vulnerability of the SOAP API interface of the Cisco Data Center Network Manager DCNM system is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...
The vulnerability of the Lenovo XClarity Administrator and Lenovo XClarity Integrator software in resource management lies in the improper limitation of XML references to external objects. This allows attackers to disclose sensitive information that should be protected.
The vulnerability of the Lenovo XClarity Administrator and Lenovo XClarity Integrator software for resource management lies in incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...
CVE-2019-16863
Cryptographic timing vulnerabilities were discovered in certain versions of the Trusted Platform Module TPM firmware distributed by Intel and STMicroelectronics. Software that uses the TPM to compute ECDSA signatures could leak information through the timing of ECDSA signature operations, allowin...
The vulnerability of the XMLFileLookupService component in the Apache NiFi data processing platform allows a hacker to gain unauthorized access to protected information.
The vulnerability of the XMLFileLookupService component in the Apache NiFi data processing platform is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protecte...
The vulnerability of the implementation of the RunExecutableListener class in the Apache Solr search server and the Apache Lucene library for full-text searching allows a perpetrator to execute arbitrary code.
The vulnerability in the implementation of the RunExecutableListener class of the Apache Solr search server and the Apache Lucene library for full-text searching is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor to...
The vulnerability of the Microsoft Visual Studio software development tool lies in the incorrect limitation on XML references to external objects, which allows attackers to read arbitrary files.
The vulnerability of the Microsoft Visual Studio software relates to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to read arbitrary files using a specially created XML file...
CVE-2019-12154
XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions...
The vulnerability of the Apache Tika XML parser and content analysis tool allows a hacker to induce a service failure.
The vulnerability of the Apache Tika XML parsing and content analysis engine is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
The vulnerability of the software platform for integrating Spring Integration corporate applications lies in improper restrictions on XML references to external objects. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the software platform for integrating Spring Integration corporate applications is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility o...
The vulnerability of the syntactic analyzer of the Microsoft XML Core Services for Windows operating systems allows a perpetrator to execute arbitrary code.
The vulnerability of the syntactic analyzer in Microsoft XML Core Services for Windows operating systems is related to errors in restricting XML references to external objects. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
Qualys Cloud Platform 2.37 New Features
This release of the Qualys Cloud Platform version 2.37 includes updates and new features for Security Assessment Questionnaire and Web Application Scanning, highlights as follows. Security Assessment Questionnaire Manager access to all active campaigns – Questionnaire Manager role now has access ...
The vulnerability of SAP Business Process Automation platform relates to errors in restricting XML references to external objects. This allows attackers to carry out attacks by injecting external XML entities into the system.
The vulnerability of the SAP Business Process Automation BPA platform relates to errors in restricting XML references to external objects, which are obtained from unverified sources. Exploiting this vulnerability allows a malicious actor to carry out an attack by injecting external XML entities a...
The vulnerability of the xmlParsePEReference component in the libxml2 library, which is used for working with XML and HTML files, allows a attacker to execute arbitrary code or cause a service failure.
The vulnerability of the xmlParsePEReference component in the libxml2 XML parsing library is related to insufficient restrictions on XML references to external objects. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service failures through a specially...
Design/Logic Flaw
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...
CVE-2018-8033
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...
CVE-2018-8033: Exposure of Sensitive Information to an Unauthorized Actor
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...
