mysql-connector-java: unauthorized access to critical

MySQL Connector/J has no security check when external general entities are included in XML sources, consequently, there exists an XML External EntityXXE vulnerability. A successful attack can access critical data and gain full control/access to all MySQL Connectors' accessible data without any...

Security Bulletin: Multiple security vulnerabilities with IBM FileNet Content Manager component in IBM Business Automation Workflow -CVE-2021-31811, CVE-2021-31812, CVE-2021-23926, CVE-2021-38965

Summary The embedded IBM FileNet Content Manager component, that is shipped with IBM Business Automation Workflow is vulnerable to multiple vulnerabilities. Vulnerability Details CVEID: CVE-2021-38965 DESCRIPTION: IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote...

Jenkins Chef Sinatra Plugin XML External Entity Injection Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins Chef Sinatra Plugin XML External Entity Injection vulnerability. An attacker can use this vulnerability to allow Jenkins to parse a crafted XML response to extract secrets...

CSRF vulnerability in Jenkins Chef Sinatra Plugin allow XXE

Jenkins Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML. As the plugin doe...

GHSA-38W8-H222-WRPP Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra

Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. As the plugin does not configure its XML parser to prevent XML external entity XXE attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for...

Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra

Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. As the plugin does not configure its XML parser to prevent XML external entity XXE attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for...

CVE-2022-25209

Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

PT-2022-17146 · Jenkins · Jenkins Chef Sinatra Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Chef Sinatra Plugin versions 1.20 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and parse an XML response. The plugin does...

PT-2022-17147 · Jenkins · Jenkins Chef Sinatra Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Chef Sinatra Plugin versions 1.20 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an...

PT-2022-17148 · Jenkins · Jenkins Chef Sinatra Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Chef Sinatra Plugin versions 1.20 and earlier Description: The issue arises from the plugin not configuring its XML parser to prevent XML external entity XXE attacks, allowing attackers to have Jenkins parse a crafted XML response for...

GHSA-3QPG-33WR-533J Improper Restriction of XML External Entity Reference in Magnolia CMS

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted XLF file...

CVE-2021-46365

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file...

CVE-2021-46365

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file...

CVE-2021-46365

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file...

Xxe

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file...

CVE-2021-46365

CVE-2021-46365 affects Magnolia CMS v6.2.3 and earlier, where the Export function processes crafted XLF files enabling XML External Entity (XXE) attacks. The reported impact is high (CVSS 3.1: High) with local exploitability and potential high confidentiality/integrity/availability impact as per ...

CVE-2021-46365

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file...

GHSA-88CC-G835-76RP Improper Restriction of XML External Entity Reference

PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE...

CVE-2022-21205

Improper restriction of XML external entity reference in DSP Builder Pro for IntelR QuartusR Prime Pro Edition before version 21.3 may allow an unauthenticated user to potentially enable information disclosure via network access...

CVE-2022-21220

Improper restriction of XML external entity for IntelR QuartusR Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access...