XML Entity Injection Vulnerability in WebLogic SimpleDocument

Oracle WebLogic Server is a Java application server that fully implements the J2EE 1.5 specification, the latest Web services standards, and the highest level of interoperability standards. An XML entity injection vulnerability exists in WebLogic SimpleDocument, which can be exploited to send a...

CVE-2018-14720

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity XXE attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization. Mitigation The following conditions are needed for an exploit, we recommend avoiding all if possibl...

XML Entity Injection Vulnerability in Mysql jdbc Driver

MySQL AB is a company founded by the founder and main developer of MySQL. An XML entity injection vulnerability exists in the Mysql jdbc driver, which can be exploited by attackers to gain server privileges...

Huawei EulerOS: Security Advisory for qt (EulerOS-SA-2020-1323)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for qt (EulerOS-SA-2020-1299)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : qt (EulerOS-SA-2020-1299)

According to the version of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to...

EulerOS 2.0 SP5 : qt (EulerOS-SA-2020-1323)

According to the version of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to...

CVE-2020-0765

An information disclosure vulnerability exists in the Remote Desktop Connection Manager RDCMan application when it improperly parses XML input containing a reference to an external entity, aka 'Remote Desktop Connection Manager Information Disclosure Vulnerability'...

CVE-2020-1693

A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute...

YouDianCMS suffers from XML entity injection vulnerability (CNVD-2020-15540)

YouDianCMS is an enterprise website management system developed by Changsha YouDian Software Technology Co. YouDianCMS suffers from an XML entity injection vulnerability. An attacker can exploit the vulnerability to read arbitrary files, execute system commands, and probe intranet ports...

Atlassian Crowd XML Processing Denial of Service Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. Atlassian Crowd has a security vulnerability. Allows remote attackers to perform...

CVE-2019-20104

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability...

CVE-2019-20104

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability...

Design/Logic Flaw

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability...

CVE-2019-20104

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability...

CVE-2019-20104

CVE-2019-20104 affects the OpenID client in Atlassian Crowd. Versions before 3.6.2, and 3.7.0 before 3.7.1, are vulnerable to DoS via XML Entity Expansion. Mitigation: update to a fixed release (3.7.1 or newer) or disable the OpenID client app, as Crowd notes indicate the OpenID client has been d...

PT-2020-10340

Name of the Vulnerable Software and Affected Versions Atlassian Crowd versions prior to 3.6.2 Atlassian Crowd versions 3.7.0 through 3.7.0 Description The issue allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability in the OpenID client application...

CVE-2019-20104: Improper Restriction of Recursive Entity References in DTDs

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability...

Security Bulletin: XML Entity Injection vulnerability affects IBM Sterling B2B Integrator (CVE-2017-1192)

Summary IBM Sterling File Gateway is vulnerable to an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2017-1192 DESCRIPTION: IB...

XML Entity Expansion

feedgen is vulnerable to XML entity expansion. The library allows parsing of XML content into existing XML tree, which would allow an attacker to perform an XML bomb attack resulting in excessive resource consumption leading to an application crash...