Dogtag PKI 代码问题漏洞

Dogtag PKI is an enterprise-class, open-source Certificate Authority CA open-sourced by Dogtag. A security vulnerability exists in Dogtag PKI's XML parser that stems from the fact that accessing an external entity while parsing an XML document could lead to an XML External Entity XXE attack. The...

Inductive Automation Ignition

1. EXECUTIVE SUMMARY CVSS v3 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Inductive Automation Equipment: Ignition Vulnerability: Improper Restriction of XML External Entity Reference 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled...

CVE-2022-2131

OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack...

Xxe

OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack...

CVE-2022-2131 OpenKM XXE Injection

OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack...

PT-2022-14948 · Openkm · Openkm Community Edition

Name of the Vulnerable Software and Affected Versions: OpenKM Community Edition versions 6.3.10 and earlier Description: The issue allows an attacker to perform an XML external entity injection attack due to the use of the XMLReader parser in the XMLTextExtractor.java file without the required...

IBM Sterling Partner Engagement Manager XML External Entity Injection Vulnerability

IBM Sterling Partner Engagement Manager is an automation management tool from IBM, Inc. An XML external entity injection vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from a network system or product that does not set the correct filtering to allow references to...

CVE-2022-32458

Digiwin BPM has a XML External Entity Injection XXE vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files...

Xxe

Digiwin BPM has a XML External Entity Injection XXE vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files...

CVE-2022-32458 Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection

Digiwin BPM has a XML External Entity Injection XXE vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files...

CVE-2022-32458

Digiwin BPM is affected by CVE-2022-32458, a XML External Entity Injection (XXE) vulnerability caused by insufficient validation of user input. An unauthenticated remote attacker can perform XML injection to access arbitrary system files. The CVSS v3.1 base score is 7.5 (HIGH) with NETWORK attack...

The vulnerability of the SAML plugin for the Apache CloudStack environment management platform allows attackers to perform XXE attacks.

The vulnerability of the SAML plugin for the Apache CloudStack environment management platform is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

CVE-2022-34001

Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously...

CVE-2022-34001

Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously...

CVE-2022-22358

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651...

CVE-2022-22358

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651...

CVE-2022-35741

Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity XXE injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When...

CVE-2022-35741

The CVE-2022-35741 issue affects Apache CloudStack 4.5.0 and later, specifically the SAML 2.0 authentication Service Provider plugin. The vulnerability is XML External Entity (XXE) injection in the XML-based SAML messages parsed during authentication. Attacker must have the plugin enabled (not en...

Security Bulletin: IBM Partner Engagement Manager is vulnerable to improper restriction of XXE (CVE-2022-22358)

Summary IBM Sterling Partner Engagement Manager has addressed an XXE vulnerability. Vulnerability Details CVEID:CVE-2022-22358 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploi...

CVE-2022-2458

An XML external entity injectionXXE vulnerability was found in Business Central. This flaw allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. T...