Design/Logic Flaw

XML Entity Expansion injection vulnerability in McAfee Endpoint Security ENS for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing...

CVE-2021-31842

The CVE-2021-31842 issue affects McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 (Sept 2021 Update). The root cause is an XML Entity Expansion injection in EPDeploy.xml processing, enabling a local user to trigger high CPU and memory usage and cause a Denial of Service. Documents consi...

CVE-2021-31842: Improper Restriction of Recursive Entity References in DTDs

XML Entity Expansion injection vulnerability in McAfee Endpoint Security ENS for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing...

McAfee Endpoint Security code-related vulnerabilities

Mcafee McAfee Endpoint Security ENS is a set of U.S. McAfee Mcafee company to provide intelligent collaboration and advanced threat defense framework. The framework supports control of the entire threat defense lifecycle for real-time communications and actionable threat forensics, among other...

PT-2021-19544

Name of the Vulnerable Software and Affected Versions McAfee Endpoint Security ENS for Windows versions prior to 10.7.0 September 2021 Update Description The issue allows a local user to initiate high CPU and memory consumption, resulting in a Denial of Service attack. This is achieved through...

Quokka code vulnerabilities

Quokka is a content management framework written in Python. quokka version 0.4.0 is vulnerable to XML external entity injection. A remote attacker can exploit this vulnerability to execute arbitrary code via the quokka/core/content/views.py component...

CVE-2021-38490

Altova MobileTogether Server before 7.3 SP1 allows XML exponential entity expansion, a different vulnerability than CVE-2021-37425...

Security Bulletin: IBM Planning Analytics Spreadsheet Services is affected by security vulnerabilities

Summary The Planning Analytics Spreadsheet Services component of IBM Planning Analytics is affected by security vulnerabilties. These have been addressed in IBM Planning Analytics Local v2.0 - Planning Analytics Spreadsheet Services Release 67. Vulnerability Details CVEID: CVE-2021-23926...

Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader a related issue to CVE-2003-1564.

...

CVE-2021-23418

The package glances before 3.2.1 are vulnerable to XML External Entity XXE Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks...

XML Entity Injection Vulnerability in jeewms

jeewms is led by Linglu Valley Technology open source project , JAVA-based warehouse management system support for self- and third-party , including PDA side and WEB side . jeewms there is an XML entity injection vulnerability , an attacker can use the vulnerability to read the server file...

XML Entity Injection Vulnerability in Minz Mobile Office System

Shenyang Mingzhi Software Co., Ltd. is one of the mainstream collaborative management software solution providers in China. An XML entity injection vulnerability exists in the Mingzhi Mobile Office system, which can be exploited by attackers to obtain sensitive information...

XML Entity Injection Vulnerability in UFIDA U8+ CRM Customer Relationship Management Software (CNVD-2021-55194)

formerly known as Shanghai Qitong Software Co., Ltd., is a management digital service company that integrates the development, consulting, marketing, training, implementation and service of management software and Internet applications. An XML entity injection vulnerability exists in UFIDA U8+ CR...

XML Entity Injection Vulnerability in UFIDA U8+ CRM Customer Relationship Management Software

formerly known as Shanghai Qitong Software Co., Ltd., is a management digital service company that integrates the development, consulting, marketing, training, implementation and service of management software and Internet applications. An XML entity injection vulnerability exists in UFIDA U8+ CR...

XML Entity Injection Vulnerability in UFIDA U8+ CRM Customer Relationship Management Software (CNVD-2021-55195)

formerly known as Shanghai Qitong Software Co., Ltd., is a management digital service company that integrates the development, consulting, marketing, training, implementation and service of management software and Internet applications. An XML entity injection vulnerability exists in UFIDA U8+ CR...

Design/Logic Flaw

The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed external entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type:...

CVE-2021-30201

CVE-2021-30201 affects Kaseya VSA (on‑premises/server side) where the API /vsaWS/KaseyaWS.asmx processes XML with external entities. The vulnerability arises from insecure handling of XML external entities, allowing an attacker to cause the server to read local files (e.g., c:\kaseya\kserver\kser...

XML Entity Injection Vulnerability in MySQL Connector/J

MySQL Connector/J is the official JDBC driver for the MySQL database. An XML entity injection vulnerability exists in MySQL Connector/J, which can be exploited by an attacker to read a file or launch an SSRF attack...

Eyoucms suffers from XML entity injection vulnerability

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework as the core development. EyouCms XML entity injection vulnerability , attackers can exploit the vulnerability to obtain sensitive information...

Advisory ROSA-SA-2021-1940

Software: openvpn 2.4.9 OS: Cobalt 7.9 CVE-ID: CVE-2020-11462 CVE-Crit: HIGH CVE-DESC: The issue was found in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. When the full-featured RPC2 interface is enabled, a temporary management interface DoS state can be reached when sending an XML...