XXE vulnerability in Storable Configs

Storable Configs 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with Item/Configure permission to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side...

SUSE-SU-2022:1678-1 Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core

This update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core fixes the following issues: Security issues fixed: - CVE-2020-36518: Fixed a Java stack overflow exception and denial of service via a large depth of nested objects in jackson-databind...

Security Bulletin: IBM Transformation Extender Advanced is Potentially Vulnerable to an XML External Entity (XXE) Injection in its REST API.

Summary IBM 10x framework used by IBM Transformation Extender Advanced REST API is vulnerable to XXE injection. The vulnerability was reported by IBM Financial Transaction Manager for ACH Services for Multi-Platform which also uses the IBM 10x framework. Vulnerability Details CVEID:CVE-2017-1758...

GHSA-2C9Q-QWRC-F486 XML External Entity Reference in org.picketlink:picketlink-common

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact vi...

GHSA-WVPV-8524-WG6X mxGraph vulnerable to XXE attacks

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...

mxGraph vulnerable to XXE attacks

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...

GHSA-C4MP-H3M2-H5MC Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference

Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

GHSA-9284-J4C9-779Q Improper Input Validation in Apache Jackrabbit

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...

Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Apache ActiveMQ

Withdrawn Advisory This advisory has been withdrawn because further investgation revealed that this is not a security issue. This link is maintained to preserve external references. Original Description XML external entity XXE vulnerability in the XPath selector component in Artemis ActiveMQ befo...

GHSA-X6RC-54XP-CCXX Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Apache ActiveMQ

Withdrawn Advisory This advisory has been withdrawn because further investgation revealed that this is not a security issue. This link is maintained to preserve external references. Original Description XML external entity XXE vulnerability in the XPath selector component in Artemis ActiveMQ befo...

GHSA-85HW-W436-C725 XML External Entity Reference in Apache Cayenne

This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a...

XML External Entity Reference in Apache Cayenne

This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a...

GHSA-57QJ-79GH-69W8 Improper Restriction of XML External Entity Reference in PMD

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it either by direct modification or MITM attacks when using remote rulesets to perform information disclosure, denial of service, or request forgery...

Incorrect Privilege Assignment in RESTEasy

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...

GHSA-PRC3-7F44-W48J Missing XML Validation in Apache Tomcat

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to 1 read arbitrary files via a crafted web application that provides an XML external entity...

Missing XML Validation in Apache Tomcat

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to 1 read arbitrary files via a crafted web application that provides an XML external entity...

GHSA-QPRX-Q2R7-3RX6 Improper Input Validation in Apache Tomcat

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a...

Improper Restriction of XML External Entity Reference in Apache uimaj

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion XXE capability of various XML parsers. UIMA as part of its...

Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple vulnerabilities due to Spring Framework

Summary Spring Framework is used by IBM Sterling B2B Integrator. Multiple vulnerabilities in Spring Framework have been addressed. Vulnerability Details CVEID: CVE-2016-9878 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to traverse directories on the system, caused by the...

XXE vulnerability in Jenkins Job Import Plugin

An XML external entity XXE processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server Jenkins queried in preparation of job import to rea...