182 matches found
CVE-2015-8866
CVE-2015-8866 describes a XXE/XEE vulnerability in PHP when using PHP-FPM, where libxml_disable_entity_loader changes are shared across threads, allowing crafted XML to exploit libxml. Affected versions include PHP prior to 5.5.22 and 5.6.x prior to 5.6.6; the issue stems from insufficient isolat...
CVE-2015-8866
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxmldisableentityloader changes in other threads, which allows remote attackers to conduct XML External Entity XXE and XML Entity Expansion XEE attacks via a crafted XML...
CVE-2015-8866: Improper Restriction of XML External Entity Reference
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxmldisableentityloader changes in other threads, which allows remote attackers to conduct XML External Entity XXE and XML Entity Expansion XEE attacks via a crafted XML...
UBNT Bug Bounty #2 - XML External Entity Vulnerability
Document Title: =============== UBNT Bug Bounty 2 - XML External Entity Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1466 Release Date: ============= 2016-04-14 Vulnerability Laboratory ID VL-ID: ==================================== 1466...
UBNT Bug Bounty #2 - XML External Entity Vulnerability
Document Title: =============== UBNT Bug Bounty 2 - XML External Entity Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1466 Release Date: ============= 2016-04-13 Vulnerability Laboratory ID VL-ID: ==================================== 1466...
Zend Framework 1.12.x < 1.12.4 / 2.1.x < 2.1.6 / 2.2.x < 2.2.6 Multiple XEE DoS
Binary data 9144.prm...
Amazon Linux: Security Advisory (ALAS-2014-377)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2015-5161
The ZendXmlSecurity::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity XXE and XML entity expansion XEE...
CVE-2015-5161
The ZendXmlSecurity::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity XXE and XML entity expansion XEE...
Xxe
The ZendXmlSecurity::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity XXE and XML entity expansion XEE...
CVE-2015-5161
CVE-2015-5161 affects ZendXml and Zend Framework components: ZendXml::scan in ZendXml < 1.0.1 and Zend Framework/Tmpl versions < 1.12.14, 2.x < 2.4.6, and 2.5.x
CVE-2015-5161: Undefined Security Weakness
The ZendXmlSecurity::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity XXE and XML entity expansion XEE...
PT-2015-6789
Name of the Vulnerable Software and Affected Versions ZendXml versions prior to 1.0.1 Zend Framework versions prior to 1.12.14 Zend Framework 2.x versions prior to 2.4.6 Zend Framework 2.5.x versions prior to 2.5.2 Description The issue allows remote attackers to bypass security checks and conduc...
CVE-2015-1819
The xmlreader in libxml allows remote attackers to cause a denial of service memory consumption via crafted XML data, related to an XML Entity Expansion XEE attack...
CVE-2015-1819
The xmlreader in libxml allows remote attackers to cause a denial of service memory consumption via crafted XML data, related to an XML Entity Expansion XEE attack...
CVE-2015-1819
The CVE-2015-1819 entry is supported by connected data showing a deterministic DoS in libxml2 via XML Entity Expansion (XEE) during XML parsing, causing memory exhaustion. Amazon Linux 2 advisory ALAS2-2019-1220 explicitly groups CVE-2015-1819 with several libxml2 DoS/memory-related CVEs and inst...
CVE-2015-1819: Undefined Security Weakness
The xmlreader in libxml allows remote attackers to cause a denial of service memory consumption via crafted XML data, related to an XML Entity Expansion XEE attack...
XXE/XEE vector when using ZendXml on multibyte payloads
More info at https://framework.zend.com/security/advisory/ZF2015-06...