CVE-2019-3772 Spring Integration XML External Entity Injection (XXE)

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2018-20233

The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian...

CVE-2018-20233

The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian...

CVE-2018-20233

CVE-2018-20233 concerns the Atlassian Universal Plugin Manager (UPM) plugin bundled with Atlassian products. The vulnerability is an XML External Entity (XXE) issue in the parsing of atlassian plugin XML files inside an uploaded JAR, exploitable by remote attackers who already have system adminis...

CVE-2018-20233

The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian...

CVE-2018-2019

IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 155265...

CVE-2018-2019

IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 155265...

CVE-2018-2019

IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 155265...

PT-2019-5717 · Spring · Spring Web Services

Name of the Vulnerable Software and Affected Versions: Spring Web Services versions 2.4.3, 3.0.4, and older unsupported versions Description: The issue is related to incorrect restriction of XML links to external objects, which can lead to XML External Entity Injection XXE when receiving XML data...

CVE-2018-20733

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE...

Oracle WebLogic Server Multiple Vulnerabilities (January 2019 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - XML external entity XXE vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read...

XML External Entity Injection (XXE)

Spring Integration is vulnerable to XML external entity injection XXE. The library does not filter malicious XML data input due to failing to disable the Document Type Definition External Entities by default...

XML External Entity Injection (XXE)

spring-ws is vulnerable to XML external entity injection XXE. The external document type definition external entities is not disabled by default and allows a remote attacker to perform XXE attacks via malicious XML data input...

Unsafe Deserialization

shopware/shopware is vulnerable to XML external entity attacks via unsafe deserialization. The sort parameter in the function loadPreviewAction in the ShopwareControllersBackendProductStream controller is not validated before PHP object instantiation is performed, which would allow an attacker to...

XML External Entity Injection (XXE)

Spring Batch Core is vulnerable to XML external entity injection XXE. The vulnerability exists because it fails to disable Document Type Definition External Entities by default, allowing an attacker to perform XXE attacks using malicious XML data input...

BlogEngine XML External Entity Injection Vulnerability

BlogEngine is an open source ASP.NET blog system . The system supports Ajax comments , custom themes and so on. An XML external entity injection vulnerability exists in BlogEngine version 3.3. Currently there is no information about this vulnerability , please stay tuned to CNNVD or vendor...

Remote Code Execution (RCE)

lucene-queryparser is vulnerable to remote code execution. This is possible through the use of an XML external entity expansion XXE attack and the Config API with add-listener command...

XML External Entity (XXE)

PySAML2 is vulnerable to XML external entity attacks XXE. The vulnerability allows remote malicious users to read arbitrary files using a SAMPL XML request or response as the injection vector for the XXE attack...

XML External Entity (XXE) Through An XSLT Extension

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity XXE attacks via a crafted XSLT extension in a 1 or 2 JSTL XML tag...

XML External Entity (XXE)

spacewalk-java is vulnerable to XML External Entity XXE attacks. The vulnerability exists as the RPC interface in Spacewalk and Red Hat Network RHN Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors...