9979 matches found
Tencent Ups Top Bug-Bounty Award to $15K
The Tencent Security Response Center TSRC is launching an expanded bug-bounty program, via the HackerOne white-hat platform – and the company has increased its top reward to $15,000. Tencent, a China-based global internet service provider, is opening up its existing bug-bounty program to...
SUSE-SU-2020:0984-1 Security update for quartz
This update for quartz fixes the following issues: - CVE-2019-13990: Fixed XML External Entity attack in initDocumentParser bsc1143227...
XML External Entity Expansion
openoffice.org is vulnerable to XML External Entity expansion. If OpenOffice.org were to open a specially-crafted file such as an OpenDocument Format or OpenDocument Presentation file, it could possibly allow a remote attacker to obtain a copy of an arbitrary local file that the user running...
HCL Technologies AppScan Standard Edition XXE Vulnerability
HCL Technologies AppScan Standard Edition is a suite of dynamic analysis testing tools from HCL Technologies, India, which is primarily used for web security testing. HCL Technologies AppScan Standard Edition suffers from an XXE vulnerability. An attacker can exploit this vulnerability to disclos...
CloudBees Jenkins Code Coverage API Plugin XXE Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . CloudBees Jenkins Code Covera...
CVE-2019-4391
HCL AppScan Standard is vulnerable to XML External Entity Injection XXE attack when processing XML data...
Xxe
HCL AppScan Standard is vulnerable to XML External Entity Injection XXE attack when processing XML data...
CVE-2019-4391
HCL AppScan Standard is vulnerable to XML External Entity Injection XXE attack when processing XML data...
CVE-2020-2172
Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
PT-2020-15382 · Jenkins · Jenkins Code Coverage Api Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Code Coverage API Plugin versions 1.1.4 and earlier Description: The issue allows a user who can control the input files for the "Publish Coverage Report" post-build step to have Jenkins parse a crafted file that uses external entitie...
CVE-2020-11586
An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data...
SUSE-SU-2020:0856-1 Security update for SUSE Manager Server 3.2
This update fixes the following issues: py26-compat-salt: - Replace pycrypto with M2Crypto as dependency for SLE15+ bsc1165425 redstone-xmlrpc: - Disable external entity parsing 1790381, bsc1164120, CVE-2020-1693 - Do not download external entities 1555429, bsc1085414, CVE-2018-1077 spacecmd: -...
CVE-2020-2138
Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
PT-2020-5085 · Jenkins · Jenkins Rapiddeploy Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins RapidDeploy Plugin versions 4.2 and earlier Description: The issue is related to the incorrect restriction of XML links to external objects, which can be exploited to perform an XML external entity XXE attack. This allows a remote...
XML External Entity (XXE)
AutoUpdater.NET is vulnerable to XML External Entity XXE. The vulnerability exists as the XML parser used in AutoUpdater does not properly restrict resolving XML external entities...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Message Broker and IBM Integration Bus
Summary Multiple security vulnerabilities exist in the IBM® Runtime Environment Java™ Technology Edition Version 6 Service Refresh 16 Fix Pack 41 and earlier releases used by WebSphere Message Broker, and the IBM® Runtime Environment Java™ Technology Edition Version 7 Service Refresh 10 Fix Pack ...
Security Bulletin: IBM Integration Bus and WebSphere Message Broker SOAP FLOWS are vulnerable to XML external entity attack (CVE-2016-9706)
Summary IBM Integration Bus and WebSphere Message Broker SOAP FLOWS are vulnerable to XML external entity attack. Vulnerability Details CVEID: CVE-2016-9706 DESCRIPTION: IBM Integration Bus and WebSphere Message Broker SOAP FLOWS are vulnerable to a denial of service attack, caused by an XML...
svglib package for Python code issue vulnerability
svglib package for Python is a Python library for reading and converting SVG files. A code issue vulnerability exists in svglib package 0.9.3 and earlier Python, which can be exploited by an attacker to conduct an XXE attack via a svg2rlg call...
PT-2020-10603 · Unknown · Autoupdater.Net
Name of the Vulnerable Software and Affected Versions: AutoUpdater.NET versions prior to 1.5.8 Description: The issue affects AutoUpdater.NET and is related to an XXE XML External Entity vulnerability in the AutoUpdater.cs file. This allows for potential exploitation. Recommendations: For version...
