XML Entity Injection Vulnerability in Oracle WebLogic Server

Oracle WebLogic Server is an Oracle Oracle application service middleware for cloud and traditional environments, which provides a modern lightweight development platform that supports the entire lifecycle management of applications from development to production and simplifies application...

JPress suffers from an XML entity injection vulnerability (CNVD-2021-30396)

JPress is a product developed using Java, similar to WordPress. JPress has an XML entity injection vulnerability that can be exploited by an attacker to read server files...

USN-4813-1: Jackson Databind vulnerabilities

It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to obtain sensitive information. CVE-2018-11307, CVE-2019-12086, CVE-2019-12814 It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could...

JFrog < 6.23.0 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 6.23.0. It is, therefore, affected by multiple vulnerabilities: - The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation. CVE-2017-18640 - The file...

JPress suffers from an XML entity injection vulnerability

JPress a use of Java development, similar to WordPress products. JPress has an XML entity injection vulnerability that can be exploited by an attacker to read server files...

ICSA-21-063-02_Schneider Electric EcoStruxure Building Operation (EBO)

1. EXECUTIVE SUMMARY CVSS v3 6.7 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: EcoStruxure Building Operation Vulnerabilities: Unrestricted Upload of File with Dangerous Type, Cross-site Scripting, Improper Restriction of XML External Entity...

CVE-2021-27184

Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability exploitable via the DTD parameter entities technique, resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input passed to...

XML Entity Injection Vulnerability in Training and Exam System of Beijing Yunfan Internet Technology Co.

Beijing Yunfan Internet Technology Co., Ltd. business scope includes: technology development, technology promotion, technology transfer, technology consulting, technical services and so on. Beijing Yunfan Internet Technology Co., Ltd. training and examination system exists XML entity injection...

Hitachi Vantara Pentaho XML Entity Extension Injection Vulnerability

Pentaho is a Business Intelligence BI software that provides data integration, OLAP services, reporting, information dashboards, data mining, and Extract, Transform, Load ETL capabilities. An XML entity extension injection vulnerability exists in the 'dashboardXml' parameter of the Dashboard Edit...

CentOS 8 : qt5-qtbase and qt5-qtwebsockets (CESA-2020:4690)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4690 advisory. - qt: XML entity expansion vulnerability CVE-2015-9541 - qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages...

CVE-2020-24665

The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service DoS condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in ...

CVE-2020-24665

The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service DoS condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in ...

Sql injection

The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service DoS condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in ...

CVE-2020-24665

The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service DoS condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in ...

CVE-2020-24665

The CVE-2020-24665 issue affects Hitachi Vantara Pentaho Dashboard Editor in the 7.x–8.x line. It is an XML Entity Expansion (XXE) injection via the dashboardXml parameter that enables an authenticated remote user to trigger a denial of service (DoS) . The root cause is the processing of external...

Hitachi Vantara Pentaho 注入漏洞

Pentaho is a Business Intelligence BI software that provides data integration, OLAP services, reporting, information dashboards, data mining, and Extract, Transform, Load ETL capabilities. An XML entity extension injection vulnerability exists in the 'dashboardXml' parameter of the Dashboard Edit...

XML Entity Injection Vulnerability in Dynamic CMS

Dynamic CMS is a web content management system based on ASP+ACCESS development. Dynamic CMS has an XML entity injection vulnerability that can be exploited by attackers to obtain sensitive information...

XML Entity Injection Vulnerability in Scrap Recycling Alliance App

Scrap Recycling Union APP is a mobile software that focuses on the functions related to scrap recycling. The Scrap Recycling Alliance APP suffers from an XML entity injection vulnerability. An attacker can exploit the vulnerability by constructing malicious entities that result in the execution o...

Cisco Firepower Management Center XML Entity Expansion (cisco-sa-fmc-xee-DFzARDcs)

The version of Cisco Firepower Management Center FMC installed on the remote host is prior to 6.6.1. It is, therefore, affected by a vulnerability in the dashboard widget that allows an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The...

XML Entity Injection Vulnerability in Alkacon OpenCms

Alkacon OpenCms is a set of open source content management system CMS developed using the Java language . Alkacon OpenCms suffers from an XML entity injection vulnerability that can be exploited by an attacker to access server resources...