33 matches found
PT-2022-13080
Name of the Vulnerable Software and Affected Versions hazelcast/hazelcast versions 5.1-BETA-1 through 5.1 Description The issue is related to an improper restriction of XML external entity references, allowing for XXE attacks. The AbstractXmlConfigRootTagRecognizer function uses a SAXParser...
in detekt/detekt
Description The read function makes use of SAXParser generated from a SAXParserFactory with no FEATURESECUREPROCESSING set, allowing for XXE attacks. In...
in jetbrains/kotlin
Description The ModuleXmlParser.parse function makes use of SAXParser generated from a SAXParserFactory with no FEATURESECUREPROCESSING set, allowing for XXE attacks. In...
PT-2022-13031
Name of the Vulnerable Software and Affected Versions corenlp affected versions not specified Description The issue is related to Improper Restriction of XML External Entity Reference. The TransformXML function uses a SAXParser generated from a SAXParserFactory with no FEATURE SECURE PROCESSING...
XML External Entity (XXE) Injection
mxgraph is vulnerable to XML external entity XXE injection attacks. These attacks are possible because the SAXParserFactory used doesn't prevent doc-type declarations DTD, allowing attackers to perform these attacks...
CVE-2017-18197
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...
Xxe
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...
CVE-2017-18197
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...
CVE-2017-18197
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...
CVE-2017-18197
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...
PT-2018-6728
Name of the Vulnerable Software and Affected Versions: mxGraph versions prior to 3.7.6 Description: The issue concerns a missing configuration in the SAXParserFactory instance within the convert function of mxGraphViewImageReader.java, which makes it susceptible to XML External Entity XXE attacks...
CVE-2017-18197: Improper Restriction of XML External Entity Reference
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...
CVE-2017-7464
It was found that the JAXP implementation used in EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing. Mitigation Enable the security features of the...