9888 matches found
CVE-2014-8924
The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity...
Debian Security Advisory DSA 3265-1 (zendframework - security update)
Multiple vulnerabilities were discovered in Zend Framework, a PHP framework. Except for CVE-2015-3154 , all these issues were already fixed in the version initially shipped with Jessie. CVE-2014-2681Lukas Reschke reported a lack of protection against XML External Entity injection attacks in some...
DSA-3265-1 zendframework - security update
Bulletin has no description...
Huawei SEQ Analyst XML External Entity Vulnerability
Huawei SEQ Analyst is Huawei's platform for monitoring service quality and managing relationships between individual users and multiple suppliers. The platform provides functions such as service debugging, user complaint handling, troubleshooting, user experience management, and deployment of...
Spacewalk and Red Hat Network (RHN) Satellite XXE Attack File Read Vulnerability
Spacewalk is a system management solution for Linux and Solaris.Red Hat Network Satellite is a system management tool based on the Linux architecture. An XML external entity vulnerability exists in the Spacewalk and Red Hat Network RHN Satellite RPC interface, which could be exploited by a remote...
Xxe
XML external entity XXE vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter...
WordPress Advanced XML Reader Plugin <= 0.3.4 - External Entity Injection
Because of this vulnerability, attackers can read system files or load the wp-config.php file. Solution Update the plugin...
WordPress Advanced XML Reader Plugin <= 0.3.4 - External Entity Injection
Because of this vulnerability, attackers can read system files or load the wp-config.php file. Solution Update the plugin...
RESTeasy: External entities expanded by DocumentProvider
It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessibl...
apache-poi: XML eXternal Entity (XXE) flaw
It was found that Apache POI would resolve entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to read files accessible to the user running the application server, and potentially perform more advanced XML External Entity...
JAX-RS: Information disclosure via XML eXternal Entity (XXE)
It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity XXE attacks on RESTEasy applications accepting XML input...
Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities XXEs in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive informati...
Xxe
XML external entity XXE in the RPC interface in Spacewalk and Red Hat Network RHN Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors...
PT-2015-4022 · Red Hat · Red Hat Network Satellite +1
Name of the Vulnerable Software and Affected Versions: Red Hat Network Satellite versions 5.7 and earlier Spacewalk versions 5.7 and earlier Description: The issue is related to an XML external entity XXE in the RPC interface. This allows remote attackers to read arbitrary files and possibly have...
Adobe Acrobat < 10.1.14 / 11.0.11 Multiple Vulnerabilities (APSB15-10)
The version of Adobe Acrobat installed on the remote host is a version prior to 10.1.14 / 11.0.11. It is, therefore, affected by the following vulnerabilities : - A buffer overflow condition exists in CoolType.dll due to improper validation of user-supplied input. A remote attacker can exploit th...
Adobe Acrobat < 10.1.14 / 11.0.11 Multiple Vulnerabilities (APSB15-10)
The version of Adobe Acrobat installed on the remote host is a version prior to 10.1.14 / 11.0.11. It is, therefore, affected by the following vulnerabilities : - A buffer overflow condition exists in CoolType.dll due to improper validation of user-supplied input. A remote attacker can exploit th...
DEBIAN-CVE-2015-3451
The clone function in XML::LibXML before 2.0119 does not properly set the expandentities option, which allows remote attackers to conduct XML external entity XXE attacks via crafted XML data to the 1 new or 2 loadxml function...
Magento XML-RPC XXE Arbitrary File Disclosure
The Magento application running on the remote web server is affected by an XML external entity injection XXE vulnerability due to improper parsing of XML data in the ZendXmlRpcServer class. A remote, unauthenticated attacker can exploit this vulnerability to view arbitrary files on the remote hos...
Moderate: Red Hat Security Advisory: spacewalk-java security update
Updated spacewalk packages that fix one security issue are now available for Red Hat Satellite 5.7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from t...
Satellite5: RPC API XML External Entities file disclosure
It was found that the RPC interface in Satellite would resolve external entities, allowing an attacker to conduct XML External Entity XXE attacks. A remote attacker could use this flaw to read files accessible to the user running the Satellite server, and potentially perform other more advanced X...