9988 matches found
PT-2020-15470 · Jenkins · Jenkins Klocwork Analysis Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Klocwork Analysis Plugin versions 2020.2.1 and earlier Description: The issue concerns an XML external entity XXE attack. This occurs because the XML parser is not configured to prevent such attacks, allowing a user who can control th...
jackson-mapper-asl: XML external entity similar to CVE-2016-3720
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity XXE vulnerability affects codehaus's jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity...
CLUSTERPRO X and EXPRESSCLUSTER X vulnerable to XML external entity injection (XXE)
Overview CLUSTERPRO X and EXPRESSCLUSTER X provided by NEC Corporation contain an XML external entity injection XXE vulnerability CWE-611. NEC Corporation reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and NEC Corporation coordinated under the Informatio...
XML External Entity (XXE)
mpxj is vulnerable to XML external entity attacks. The XMLFilter is configured with external DTDs by default, allowing an attacker to perform XXE attacks to access system files or perform requests on behalf of the server...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Terracotta Quartz Scheduler
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Terracotta Quartz Scheduler. Vulnerability Details CVEID: CVE-2019-13990 DESCRIPTION: Terracotta could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external enti...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache POI
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache POI. Vulnerability Details CVEID: CVE-2019-12415 DESCRIPTION: Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML da...
PT-2020-5503 · Mpxj · Mpxj
Name of the Vulnerable Software and Affected Versions: MPXJ versions 8.1.3 and earlier Description: The issue is related to the incorrect restriction of XML external entity references in the GanttProjectReader and PhoenixReader components of the MPXJ library. This can allow a remote attacker to...
CVE-2020-24656
Maltego before 4.2.12 allows XXE attacks...
The vulnerability in the implementation of the new org.dom4j.io.SAXReader() function of the library for working with XML, XPath, and XSLT in dom4j allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the new org.dom4j.io.SAXReader method in the library for working with XML, XPath, and XSLT is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...
WECON LeviStudioU (Update C)
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: WECON Technology Co., Ltd WECON Equipment: LeviStudioU --------- Begin Update C Part 1 of 3 --------- Vulnerabilities: Stack-based Buffer Overflow, Improper Restriction of XML External Entity Reference, Heap-based...
Debian DLA-2342-1 : libjackson-json-java security update
Several vulnerabilities were fixed in libjackson-json-java, a Java JSON processor. CVE-2017-7525 Jackson Deserializer security vulnerability. CVE-2017-15095 Block more JDK types from polymorphic deserialization. CVE-2019-10172 XML external entity vulnerabilities. For Debian 9 stretch, these...
XML External Entity (XXE)
wildfly-jdr is vulnerable to XML External Entity XXE. The vulnerability exists through the inclusion of a vulnerable version of xerces...
CVE-2020-24589
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection XXE attacks...
CVE-2020-24589
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection XXE attacks...
Xxe
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection XXE attacks...
CVE-2020-24589
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection XXE attacks...
PT-2020-15752 · Wso2 · Api Microgateway +1
Name of the Vulnerable Software and Affected Versions: WSO2 API Manager versions prior to 3.1.0 API Microgateway version 2.2.0 Description: The issue allows XML External Entity injection XXE attacks. XXE attacks occur when an application parses XML input that contains malicious external entities,...
CVE-2020-24590
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks. Recent assessments: krzysztof-przybylski at August 29, 2020 11:16pm UTC reported: Severity: Critical CVSS Score: 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H AFFECTED...
