9929 matches found
jBPM Migration XML External Entity Injection Vulnerability
jBPM Migration is a migration tool. jBPM Migration is implemented with an XML external entity injection vulnerability that can be exploited by remote attackers to submit a special request, obtain sensitive information, or conduct a denial of service attack...
CVE-2017-14101
A security researcher found an XML External Entity XXE vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical Imaging Company, which is now a Change Healthcare company. An unauthenticated user supplying a modified HTTP SOAP request to the vulnerable...
JDK: XML External Entity Injection (XXE) error when processing XML data
IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150...
Moderate: Red Hat Security Advisory: rh-java-common-lucene security update
An update for rh-java-common-lucene is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2016-4216
XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...
Cimetrics BACnet Explorer 4.0 XXE Vulnerability
Summary The BACnet Explorer is a BACnet client application that helps auto discover BACnet devices. Description BACnetExplorer suffers from an XML External Entity XXE vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected...
Developers Targeted in ‘ParseDroid’ PoC Attack
Researchers have developed a proof of concept attack that could impact the millions of users of integrated development environments such as Intellij, Eclipse and Android Studio. Attacks can also be carried out against servers hosting development environments in the cloud. The attack vector was...
XML External Entity (XXE)
scapy is vulnerable to XML external entity XXE attacks. The application does not by default disable entity resolution, allowing a malicious user to pass a XML sitemap to the application and create external entities that can lead to information disclosure or other impacts...
XML External Entity (XXE)
Adobe xmpcore is vulnerable to XML external entity XXE attacks. The attacks are possible because it does not properly handle the XML data containing an external entity declaration in conjunction with an entity reference, allowing users to read arbitrary files...
CVE-2017-11286
Adobe ColdFusion has an XML external entity XXE injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11...
Xxe
Adobe ColdFusion has an XML external entity XXE injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11...
XML External Entity (XXE)
jbpm-designer-backend is vulnerable to XML external entity XXE attacks. The application does not parse XML documents properly, allowing a malicious user to conduct a XML external entity attack...
Apache Roller < 5.0.3 XXE Vulnerability
Apache Roller is prone to an XML external entity XXE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:roller...
XML External Entity (XXE) Injection
itextpdf is vulnerable to XML external entity XXE injection attacks. These attacks are possible because the library does not disable external entities when parsing pdf files...
Diving Log 6.0 - XML External Entity Injection
Diving Log 6.0 - XML External Entity Injection + Exploit Title: Diving Log 6.0 XXE Injection + Date: 27-11-2017 + Exploit Author: Trent Gordon + Vendor Homepage: http://www.divinglog.de + Software Link: http://www.divinglog.de/english/download/ + Disclosed at: https://thenopsled.com/divinglog.txt...
WordPress TablePress Plugin XXE Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.140537";...
SimpleXML XML External Entity Injection Vulnerability
SimpleXML is a Java-based high-performance XML serialization and configuration framework. An XML external entity injection vulnerability exists in SimpleXML version 2.7.1. An attacker can exploit this vulnerability to implement a server-side request forgery attack to obtain sensitive information ...
XML External Entity (XXE)
simple-xml is vulnerable to XML Exeternal Entity XXE attacks. The library does not properly disable external entities during deserialization, allowing a malicious user to inject and execute arbitrary code through it or reveal sensitive information...
