SUSE-SU-2020:1383-1 Security update for dom4j

This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser bsc1169760...

Amazon Linux 2 : xerces-c (ALAS-2020-1415)

The version of xerces-c installed on the remote host is prior to 3.1.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1415 advisory. A use-after-free vulnerability was found in xerces-c in the way an XML document is processed via the SAX API. Applications that...

Important: xerces-c

Issue Overview: A use-after-free vulnerability was found in xerces-c in the way an XML document is processed via the SAX API. Applications that process XML documents with an external Document Type Definition DTD may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating...

xerces-c: XML parser contains a use-after-free error triggered during the scanning of external DTDs

A use-after-free vulnerability was found in xerces-c in the way an XML document is processed via the SAX API. Applications that process XML documents with an external Document Type Definition DTD may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially...

Microsoft SharePoint - Deserialization Remote Code Execution Exploit

!/usr/bin/env python3 -- coding: utf-8 -- import requests import sys from xml.sax.saxutils import escape from lxml import html import codecs import readline from clint.arguments import Args import signal def serializecommandcmd: total = "" for x in cmd: a = codecs.encodex,"utf-16be" b =...

CVE-2018-1311

A use-after-free vulnerability was found in xerces-c in the way an XML document is processed via the SAX API. Applications that process XML documents with an external Document Type Definition DTD may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially...

CVE-2018-1311

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...

CVE-2018-1311

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...

CVE-2018-1311

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...

Design/Logic Flaw

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...

CVE-2018-1311

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...

CVE-2018-1311

CVE-2018-1311 describes a use-after-free in the Apache Xerces-C++ XML parser when scanning external DTDs. Publicly reported ranges indicate impact on Xerces-C versions 3.0.0–3.2.3, with no fixes in those older maintained lines and mitigation limited to disabling DTD processing (via DOM feature or...

CVE-2018-1311

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...

CVE-2018-1311

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...

XML External Entity (XXE)

jersey-core is vulnerable to XML external entity attacks. The external parameter entities were not disabled by the jersey SAX parser, allowing a remote attacker to exploit the vulnerability to read files accessible to the user running the application server, and potentially perform recursive enti...

CVE-2014-3643

jersey: XXE via parameter entities not disabled by the jersey SAX parser...

Design/Logic Flaw

jersey: XXE via parameter entities not disabled by the jersey SAX parser...

CVE-2014-3643

CVE-2014-3643 is an XXE vulnerability in Jersey's SAX XML parsing path. The issue allows a remote attacker to obtain sensitive information by sending specially crafted XML data to Jersey that is parsed by the SAX parser with parameter entities not disabled. The IBM bulletin for IBM DevOps Release...

CVE-2014-3643

jersey: XXE via parameter entities not disabled by the jersey SAX parser...

tika: Incomplete fix allows for XML entity expansion resulting in denial of service

In Apache Tika 1.19 CVE-2018-11761, we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after...