CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

PT-2017-16812

Name of the Vulnerable Software and Affected Versions Openpyxl versions prior to 2.4.1 Description The issue allows remote attackers to conduct XXE attacks via a crafted .xlsx document, as Openpyxl resolves external entities by default. Recommendations For versions prior to 2.4.1, update to versi...

CVE-2017-5992: Improper Restriction of XML External Entity Reference

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

PT-2016-5819

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev8 Description An issue was discovered where references to external Open XML document type definitions .dtd resources can be placed within .docx and .xslx files. When parsing certain parts of...

CVE-2016-4047: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions .dtd resources can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker...

DEBIAN-CVE-2016-5000

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

UBUNTU-CVE-2016-5000

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Open-Xchange AppSuite Information Disclosure Vulnerability (CNVD-2016-04412)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. An information disclosure vulnerability exists in OX AppSuite 7.8.1 and earlier...

Informatica: [rev-app.informatica.com] - XXE

Open file xxe.xlsx like zip-archive 2. Read file xxe.xlsx\xl\worksheets\sheet1.xml In file I wrote XXE payload: Then, i went to https://rev-app.informatica.com and made new project and imported my XLSX-file When it was impoted i see /etc/passwd file: root:x:0:0:root:/root:/bin/bash...

[SECURITY] Fedora 20 Update: apache-poi-3.10.1-2.fc20

The Apache POI Project's mission is to create and maintain Java APIs for manipulating various file formats based upon the Office Open XML standards OOXML and Microsoft's OLE 2 Compound Document format OLE2. In short, you can read and write MS Excel files using Java. In addition, you can read and...

Microsoft Excel XLSX File Parsing Code Execution (MS10-017) - Ver2 (CVE-2010-0263)

Microsoft Excel is a popular spreadsheet application. A remote code execution vulnerability has been identified in Microsoft Excel. The vulnerability is due to an error in Microsoft Office Excel that fails to properly parse the Excel spreadsheet file format. A remote attacker could trigger this...

Fedora Update for apache-poi FEDORA-2012-7683

Check for the Version of apache-poi OpenVAS Vulnerability Test Fedora Update for apache-poi FEDORA-2012-7683 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

SuSE 10 Security Update : LibreOffice (ZYPP Patch Number 8022)

LibreOffice 3.4.5 includes many fixes over the previous LibreOffice 3.4.2.6 update. The update fixes the following security issues : - 740453: Vulnerability in RDF handling. CVE-2012-0037 - 752595: overflow in jpeg handling. CVE-2012-1149 - 736146: buffer overflow in the build in icu copy 736146...

Microsoft Windows数据访问组件DLL装载任意代码执行漏洞

Bugtraq ID: 49026 CVE ID：CVE-2011-1975 Microsoft Windows是一款流行的操作系统。 Window数据访问跟踪组件不安全装载库，攻击者可以诱使用户在远程WebDAV或SMB共享上打开Microsoft Excel.xlsx 文件，可以以用户安全上下文装载任意库。 Microsoft Windows Server 2008 Standard Edition X64 Microsoft Windows Server 2008 Standard Edition SP2 Microsoft Windows Server 2008 Standard...

CVE-2010-0263

Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server 2007 SP1 and SP2 do not validate ZIP headers...

Remote code execution

Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server 2007 SP1 and SP2 do not validate ZIP headers...

CVE-2010-0263

Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server 2007 SP1 and SP2 do not validate ZIP headers...

CVE-2010-0263

CVE-2010-0263 concerns Microsoft Office Excel XLSX File Parsing Code Execution. The vulnerability arises from insufficient validation of ZIP headers during decompression of Open XML XLSX documents, enabling remote code execution via a crafted file that accesses uninitialized memory. Affected soft...

CVE-2010-0263: Improper Control of Generation of Code

Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server 2007 SP1 and SP2 do not validate ZIP headers...

Microsoft Excel XLSX文件解析远程代码执行漏洞（MS10-017）

BUGTRAQ ID: 38554 CVE ID: CVE-2010-0263 Excel是微软Office套件中的电子表格工具。 XLSX文件是组成新的开放XML文档相关内容的ZIP档案文件。在解压XLSX文件中的某些XML元素时由于没有验证ZIP头，可能会导致执行未初始化的内存。成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Excel Viewer SP2 Microsoft Excel Viewer SP1 Microsoft Excel 2007 SP2 Microsoft...