94 matches found
CVE-2020-35460
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
CVE-2020-35460
CVE-2020-35460 : In MPXJ (Packwood), the InputStreamHelper.java component allows directory traversal in the zip stream handler flow, enabling writing files to arbitrary locations. This is due to insufficient validation of pathnames in the traversal path. Affected file/component: common/InputStrea...
CVE-2020-35460
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
CVE-2020-35460: Improper Limitation of a Pathname to a Restricted Directory
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...
XML External Entity (XXE)
mpxj is vulnerable to XML external entity attacks. The XMLFilter is configured with external DTDs by default, allowing an attacker to perform XXE attacks to access system files or perform requests on behalf of the server...
CVE-2020-25020
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...
CVE-2020-25020
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...
Design/Logic Flaw
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...
CVE-2020-25020
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...
CVE-2020-25020
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...
CVE-2020-25020
CVE-2020-25020 is an XML External Entity (XXE) vulnerability in MPXJ up to 8.1.3 that affects the GanttProjectReader and PhoenixReader components. The CVE entry has a US/NE expansion with a CRITICAL 9.8 base score (CVSSv3.1) and a network-based, low-complexity attack vector with no authentication...
CVE-2020-25020
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...
CVE-2020-25020: Improper Restriction of XML External Entity Reference
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...