CVE-2014-3574

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service CPU consumption and crash via a crafted OOXML file, aka an XML Entity Expansion XEE attack...

PT-2014-5401

Name of the Vulnerable Software and Affected Versions Apache POI versions prior to 3.10.1 Apache POI versions 3.11.x prior to 3.11-beta2 Description The issue allows remote attackers to cause a denial of service, resulting in CPU consumption and crash, via a crafted OOXML file. This is achieved...

CVE-2014-3574: Undefined Security Weakness

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service CPU consumption and crash via a crafted OOXML file, aka an XML Entity Expansion XEE attack...

XML Entity Cheatsheet

An XML Entity testing cheatsheet. Testing was done using an older vulnerable version of nokogiri. In IRB you can require previous versions of gems. Certain techniques e.g. XInclude may require additional settings in Nokogiri. XML Headers: 1 2 | ---|--- Vanilla entity test: 1 | ---|--- SYSTEM enti...

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

MGASA-2014-0328 Updated wordpress packages fix security vulnerabilities

Multiple vulnerabilities in WordPress before 3.9.2, including denial of service and information disclosure issues related to XML entity expansion. The wordpress package has been updated to version 3.9.2 to fix these issues. See the release announcement for more details...

Updated wordpress packages fix security vulnerabilities

Multiple vulnerabilities in WordPress before 3.9.2, including denial of service and information disclosure issues related to XML entity expansion. The wordpress package has been updated to version 3.9.2 to fix these issues. See the release announcement for more details...

MGASA-2014-0329 Updated drupal packages fix security vulnerability

A denial of service issue exists in Drupal before 7.31, due to XML entity expansion in a publicly accessible XML-RPC endpoint. The drupal package has been updated to version 7.31 to fix this issue and other bugs. See the upstream advisory and release notes for more details...

PT-2014-9137

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.9.2 Description The issue concerns multiple vulnerabilities, including denial of service and information disclosure problems related to XML entity expansion. Recommendations For versions prior to 3.9.2, update to...

PT-2014-9138

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.31 Description A denial of service issue exists due to XML entity expansion in a publicly accessible XML-RPC endpoint. Recommendations For versions prior to 7.31, update to version 7.31 to fix this issue and other bu...

CVE-2014-0179

libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service read block and hang via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the 1 virConnectCompareCPU or 2 virConnectBaselineCPU API method, relate...

RHEL 7 : libvirt (RHSA-2014:0914)

Updated libvirt packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

openSUSE Security Update : libqt4 (openSUSE-SU-2014:0070-1)

Fixes XML Entity Expansion Denial of Service bnc856832, CVE-2013-4549 - add backported patch libqt4-disallow-deep-or-widely-nested-entity-references. patch - add backported patch libqt4-fully-expand-all-entities.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : libqt4 (openSUSE-SU-2014:0067-1)

Fixes XML Entity Expansion Denial of Service bnc856832, CVE-2013-4549 - add backported patch libqt4-disallow-deep-or-widely-nested-entity-references. patch - add backported patch libqt4-fully-expand-all-entities.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : libqt4 (openSUSE-SU-2014:0125-1)

Fixes XML Entity Expansion Denial of Service bnc856832, CVE-2013-4549 - add backported patch libqt4-disallow-deep-or-widely-nested-entity-references. patch - add backported patch libqt4-fully-expand-all-entities.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : libqt5-qtbase (openSUSE-SU-2014:0173-1)

added patches : - disallow-deep-or-widely-nested-entity-references.patch: upstream fix for bnc856832 and CVE-2013-4549: xml entity expansion attacks %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

CentOS Update for libvirt CESA-2014:0560 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-2194

system/egain/chat/entrypoint in Cisco Unified Web and E-mail Interaction Manager 9.02 allows remote attackers to have an unspecified impact by injecting a spoofed XML external entity...

GLSA-201405-14 : Ruby OpenID: Denial of Service

The remote host is affected by the vulnerability described in GLSA-201405-14 Ruby OpenID: Denial of Service An XML entity parsing error has been discovered in Ruby OpenID. Impact : A remote attacker could send a specially crafted XML file, possibly resulting in a Denial of Service condition...

Nixu NameSurfer多个安全漏洞

CVE ID:CVE-2014-0060、CVE-2014-0061、CVE-2014-0062、CVE-2014-0063、CVE-2014-0064、CVE-2014-0065、CVE-2014-0066 Nixu NameSurfer是一个实现集中地址管理覆盖的IPAM软件应用解决方案。 Nixu NameSurfer存在多个安全漏洞： 1，部分输入在使用之前缺少过滤，允许攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 2，解析XML实体时存在错误，允许攻击者利用特制的包含外部实体引用的XML文档来获取本地资源数据或消耗服务器资源。...