31845 matches found
CVE-2019-15042
An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1...
CVE-2019-10466
An XML external entities XXE vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks...
CVE-2018-16987
Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code...
CVE-2018-1000831
K9Mail version = v5.600 contains a XML External Entity XXE vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDA...
CVE-2018-16521
An XML External Entity XXE vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0...
CVE-2018-1000836
bw-calendar-engine version = bw-calendar-engine-3.12.0 contains a XML External Entity XXE vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious...
CVE-2018-20298
S3 Browser before 8.1.5 contains an XML external entity XXE vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol...
CVE-2018-1000012
Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...
CVE-2018-16153
An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations...
CVE-2018-1000825
FreeCol version = nightly-2018-08-22 contains a XML External Entity XXE vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Freecol file...
CVE-2018-1000124
I Librarian I-librarian version 4.8 and earlier contains a XML External Entity XXE vulnerability in line 154 of importmetadata.phpsimplexmlloadstring that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter...
CVE-2018-1000834
runelite version = runelite-parent-1.4.23 contains a XML External Entity XXE vulnerability in Man in the middle runscape services call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning...
CVE-2018-1000010
Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...
CVE-2017-1000497
Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution...
Passback vulnerabilities in Canon Production Printers, Office/Small Office Multifunction Printers, and Laser Printers
Overview Production Printers, Office/Small Office Multifunction Printers, and Laser Printers provided by Canon Inc. do not implement sufficient protection on credential information CWE-522. CVE-2025-3078, CVE-2025-3079 Canon Inc. reported these vulnerabilities to JPCERT/CC to notify users of the...
CVE-2013-4335
opOpenSocialPlugin 0.8.2.1, 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities...
CVE-2012-4553
Drupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re-install Drupal and execute arbitrary PHP code via an external database server, related to "transient conditions."...
CVE-2017-15685
Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity XXE. An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band...