XML External Entity (XXE)

PostgreSQL JDBC Driver is vulnerable to XML external entity attacks. External DTDs are not disabled by default, allowing an attacker to perform XXE attacks and perform request on behalf of the server or retrieve system files via a malicious XML document...

DEBIAN-CVE-2020-13692

PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE...

UBUNTU-CVE-2020-13692

PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE...

CVE-2020-4509

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182364...

CVE-2020-4509

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182364...

XML External Entity (XXE)

plesk/zf1 is vulnerable to XML external entity XXE. The library does not properly encode !ENTITY string in function heuristicScan in Security.php when threading is enabled during the Byteordermark BOM detection, allowing a malicious user to exploit this flaw by providing multibyte XML string or...

Security Bulletin: IBM QRadar is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2020-4509)

Summary IBM QRadar is vulnerable to an XML External Entity Injection XXE attack when processing XML data Vulnerability Details CVEID: CVE-2020-4509 DESCRIPTION: IBM QRadar is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...

ABB Central Licensing System

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: Central Licensing System CLS Vulnerabilities: Information Exposure; Improper Restriction of XML External Entity Reference; Uncontrolled Resource Consumption; Permissions, Privilege,...

openSUSE Security Update : dom4j (openSUSE-2020-719)

This update for dom4j fixes the following issues : - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser bsc1169760. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerabilities. Cxf-core-3.0.3 java library has multiple known vulnerabilities. Vulnerability Details CVEID: CVE-2015-5253 DESCRIPTION: Apache CXF could allow a remote attacker t...

openSUSE: Security Advisory for dom4j (openSUSE-SU-2020:0719-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0719-1 Security update for dom4j

This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser bsc1169760. This update was imported from the SUSE:SLE-15:Update update project...

Security update for dom4j (important)

openSUSE Security Update: Security update for dom4j Announcement ID: openSUSE-SU-2020:0719-1 Rating: important References: 1169760 Cross-References: CVE-2020-10683 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for dom4j fix...

SUSE-SU-2020:1382-1 Security update for dom4j

This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser bsc1169760...

Debian: Security Advisory (DLA-2211-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2211-1] log4net security update

Package : log4net Version : 1.2.10+dfsg-6+deb8u1 It was discovered that there was an XML external entity vulnerability in log4net, a logging API for the ECMA Common Language Infrastructure CLI, sometimes referred to as "Mono". This type of attack occurs when XML input containing a reference to an...

CVE-2020-2012

Improper restriction of XML external entity reference 'XXE' vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of...

Xxe

Improper restriction of XML external entity reference 'XXE' vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of...

jackson-mapper-asl: XML external entity similar to CVE-2016-3720

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity XXE vulnerability affects codehaus's jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity...

Apache log4net XXE Vulnerability

Apache log4net is the United States Apache Apache Software Foundation, a logging output tool. A security vulnerability exists in the parsing of log4net configuration files in Apache log4net versions prior to 2.0.8. An attacker can exploit this vulnerability to force the system to accept arbitrary...