1235 matches found
Information Disclosure Through Embedded Batik Jar
Apache FOP is vulnerable to information disclosure. This is because of an embedded batik jar in this library. Apache batik is vulnerable to information disclosure through external XML entity XXE. A malicious user can send a SVG file to the application to cause an XXE to reveal information in...
Information Disclosure Through An External XML Entity (XXE) Vulnerability
Apache Batik is vulnerable to information disclosure through an external XML entity XXE vulnerability. The vulnerability is possible because it does not properly validate the file when handling a maliciously formed SVG file. Using this flaw, attackers can gain access to confidential information a...
python-pysaml2: Entity expansion issue
An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion...
python-pysaml2: Entity expansion issue
An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion...
External XML Entity (XXE) Attacks
ignite-core is vulnerable external XML entity XXE attacks. The update notifier component sends sensitive system data over an unsecured HTTP connection. Since TLS is not used man-in-the-middle MitM attacks also possible. Attackers can alter the response coming from the server the information is se...
IBM Jazz Foundation External Entity Injection Vulnerability
IBM Jazz Foundation is a scalable and extensible team collaboration platform that integrates tasks across the software lifecycle, and which provides useful building blocks and frameworks that help develop new products and tools. IBM Jazz Foundation suffers from an XML External Entity Injection XX...
Design/Logic Flaw
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...
CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...
DEBIAN-CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...
CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...
CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...
UBUNTU-CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...
CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...
CVE-2017-5644
CVE-2017-5644 affects Apache POI: versions prior to 3.15 are vulnerable to an XML Entity Expansion (XEE) denial of service via a specially crafted OOXML file, causing high CPU usage. Documented impact is a CPU consumption DoS rather than code execution. Public references in the connected material...
CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...
Pidgin < 2.12.0 libpurple/util.c purple_markup_unescape_entity() XML Entity Handling RCE
The version of Pidgin installed on the remote Windows host is prior to 2.12.0. It is, therefore, affected by a remote code execution vulnerability in the libpurple library in util.c due to an out-of-bounds writer error in the purplemarkupunescapeentity function that is triggered when handling...
Denial Of Service (DoS) Via XML External Expansion (XEE)
poi-ooxml is vulnerable to denial of service DoS attacks. The vulnerability exists via an XML Entity Expansion XEE attack when parsing a malicious OOXML file...
Design/Logic Flaw
XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service...