UBUNTU-CVE-2018-1000832

ZoneMinder version = 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

PT-2018-9549 · Freecol +1 · Freecol +1

Name of the Vulnerable Software and Affected Versions: FreeCol versions prior to nightly-2018-08-23 Description: The issue concerns a XML External Entity XXE vulnerability in the FreeColXMLReader parser. This can lead to disclosure of confidential data, denial of service, Server-Side Request...

xmlrpc: XML external entity vulnerability SSRF via a crafted DTD

XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery SSRF attacks via a crafted DTD...

Microsoft Exchange Server Rollup Server-Side Request Forgery Vulnerability

Microsoft Exchange Server is the United States Microsoft Microsoft a set of e-mail services program, which provides mail access, storage, forwarding, voice mail, mail filtering and screening functions.Rollup is used in one of the code packer. A server-side request forgery vulnerability exists in...

IBM API Connect Server-Side Request Forgery Vulnerability

IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. A server-side request forgery vulnerability exists in IBM API Connect versions 2018.1.0 through...

CVE-2017-7464

It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing...

UBUNTU-CVE-2018-1000546

Triplea version = 1.9.0.0.10291 contains a XML External Entity XXE vulnerability in Importing game data that can result in Possible information disclosure, server-side request forgery, or remote code execution. This attack appear to be exploitable via Specially crafted game data file XML...

UBUNTU-CVE-2018-1000548

Umlet version 14.3 contains a XML External Entity XXE vulnerability in File parsing that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially crafted UXF file. This vulnerability appears to have been fixe...

Portainer Access Restriction Bypass and Server-Side Request Forgery Vulnerabilities

Portainer is a lightweight user management interface for managing Docker environments and Docker hosts. A security vulnerability exists in Portainer versions prior to 1.18.0 that stems from the program's support for requests with unvalidated id query parameters. A remote attacker could use this...

CVE-2017-3206

The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references XXEs from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, deni...

CVE-2018-11586

XML external entity XXE vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CloudBees Jenkins Checkstyle plugin XML external entity injection vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Checkstyle Plugin is used in one of...

CloudBees Jenkins DRY plugin XML external entity injection vulnerability

CloudBees Jenkins is the U.S. CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks . DRY Plugin is used in one of the duplicate code to simplify t...

camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE

It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...

Belden Hirschmann GECKO Server-Side Request Forgery Vulnerability

The Belden Hirschmann GECKO is the lean managed industrial Ethernet switch. A server-side request forgery vulnerability exists in the Belden Hirschmann GECKO switch. The vulnerability stems from the program failing to adequately validate requests. An attacker could exploit the vulnerability by...

CVE-2017-6130

F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery SSRF attack when deployed using the Dynamic Domain Bypass DDB feature feature plus SNAT Auto Map option for egress traffic...

UBUNTU-CVE-2016-7999

ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery SSRF attacks via a URL in the varurl parameter in a validerxml action...

QlikTech Qlikview XML External Entity Vulnerability

QlikTech Qlikview is a business discovery platform that provides users with self-service BI Business Intelligence from QlikTech, USA. The platform supports consolidation of data from multiple sources into a single application, data visualization through new graphical techniques, and interaction...

Python多个安全漏洞

CVE ID:CVE-2013-1752、CVE-2013-4238 Python是一款开放源代码的脚本编程语言。 Python存在多个安全漏洞，允许远程攻击者利用漏洞进行伪造攻击和进行拒绝服务攻击。 1，Python SSL模块没有正确处理服务器SSL证书中的"subjectAltNames"通用名的空字节，允许攻击者通过中间人攻击进行服务器伪造攻击，可获取敏感信息。 2，不受限的调用Lib/httplib.py中的"readline"可导致消耗大量内存资源，造成拒绝服务攻击。 3，不受限的调用Lib/ftplib.py中的"readline"可导致消耗大量内存资源，造成拒绝服务攻击。...