EulerOS Virtualization 2.5.1 : ruby (EulerOS-SA-2018-1374)

According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause ...

Fr. Sauter AG CASE Suite

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Fr. Sauter AG Equipment: CASE Suite Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

EulerOS Virtualization 2.5.0 : libxml2 (EulerOS-SA-2018-1336)

According to the version of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity...

GHSA-MH7G-99W9-XPJM Remote code execution occurs in Apache Solr

Remote code execution occurs in Apache Solr before versions 5.5.5, 6.6.2 and 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

GHSA-73CQ-FHP3-8RPW Moderate severity vulnerability that affects org.restlet.jse:org.restlet

Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion XEE attack...

See how I found Yahoo Mail APP stored XSS vulnerability-vulnerability warning-the black bar safety net

! Today I want to share is to participate in Yahoo（Yahoo!） Vulnerability all test items to find the one on Yahoo Mail iOS app vulnerability, and ultimately, by virtue of the vulnerability, I go into the Yahoo security Hall of Fame and get a$3500 dollar reward. Vulnerability case My test object is...

Smooth Site Group CMS system suffers from xml entity injection vulnerability

Smooth Web Group CMS System is a management system developed by Liaoning Smooth Data Communication Co., Ltd. which is mainly applied to the construction of Liaoning education campus informatization management platform, healthcare informatization management system, enterprise resource management...

DEBIAN-CVE-2018-11761

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack...

Zenmap Nmap 7.70 - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: Nmap 7.70 - Denial of Service PoC Author: Gionathan "John" Reale Software Link: https://nmap.org/dist/nmap-7.70-setup.exe Tested Version: 7.70 ZenMap Tested on OS: Windows 7 32bit Description: This vunerability causes the program t...

CVE-2018-13826

An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks...

CVE-2018-13823

An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information...

GHSA-Q7WX-62R7-J2X7 Nokogiri vulnerable to libxml XML Entity Expansion

The xmlreader in libxml allows remote attackers to cause a denial of service memory consumption via crafted XML data, related to an XML Entity Expansion XEE attack...

Nokogiri vulnerable to libxml XML Entity Expansion

The xmlreader in libxml allows remote attackers to cause a denial of service memory consumption via crafted XML data, related to an XML Entity Expansion XEE attack...

Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary XML Entity Expansion vulnerability CVE-2018-1702 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1702 DESCRIPTION: IBM Spectrum Symphony is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could...

feedparser denial of service vulnerability

Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document...

Oracle WebLogic wls_utc wsdl service suffers from an xml entity injection vulnerability.

WebLogic is the United States Oracle Corporation produced a middleware based on the JAVAEE architecture , is used to develop , integrate , deploy and manage large-scale distributed Web applications , network applications and database applications of Java application servers . An xml entity...

CVE-2016-9487 EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf...

Security Bulletin: XML entity expansion vulnerabilities in ClearCase (CVE-2014-3090)

Summary IBM Rational ClearCase is vulnerable to XML entity expansion attacks. These attacks could cause a denial of service. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login wit...

ventrian News-ArticlesXML External Entity Injection Vulnerability

ventrian News-Articles is a backend system for publishing and managing news. An XML external entity injection vulnerability exists in the News-Articles/API/MetaWebLog/Handler.ashx.vb file in ventrian News-Articles version 00.09.11. An attacker can use this vulnerability to read arbitrary files on...

Security Bulletin: Multiple vulnerabilities affect Rational Rhapsody Design Manager with potential for security attacks

Summary IBM Rhapsody Design Manager is affected by multiple vulnerabilities with potential for evil file upload, cross site scripting, HTML injection, JSON Hijacking and XML entity expansion. Vulnerability Details CVEID: CVE-2016-8973 DESCRIPTION: IBM Rhapsody DM contains an undisclosed...