7442 matches found
SUSE-SU-2020:1009-1 Security update for quartz
This update for quartz fixes the following issues: - CVE-2019-13990: Fixed XML External Entity attack in initDocumentParser bsc1143227...
EulerOS Virtualization 3.0.2.2 : expat (EulerOS-SA-2020-1445)
According to the versions of the expat packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an...
Tencent Ups Top Bug-Bounty Award to $15K
The Tencent Security Response Center TSRC is launching an expanded bug-bounty program, via the HackerOne white-hat platform – and the company has increased its top reward to $15,000. Tencent, a China-based global internet service provider, is opening up its existing bug-bounty program to...
CVE-2020-6238
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability partially of SAP Commerce...
SUSE-SU-2020:0984-1 Security update for quartz
This update for quartz fixes the following issues: - CVE-2019-13990: Fixed XML External Entity attack in initDocumentParser bsc1143227...
XML External Entity Expansion
openoffice.org is vulnerable to XML External Entity expansion. If OpenOffice.org were to open a specially-crafted file such as an OpenDocument Format or OpenDocument Presentation file, it could possibly allow a remote attacker to obtain a copy of an arbitrary local file that the user running...
Xxe
HCL AppScan Standard is vulnerable to XML External Entity Injection XXE attack when processing XML data...
CVE-2019-4391
HCL AppScan Standard is vulnerable to XML External Entity Injection XXE attack when processing XML data...
CVE-2020-2172
Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
PT-2020-15382 · Jenkins · Jenkins Code Coverage Api Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Code Coverage API Plugin versions 1.1.4 and earlier Description: The issue allows a user who can control the input files for the "Publish Coverage Report" post-build step to have Jenkins parse a crafted file that uses external entitie...
CVE-2020-11586
An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data...
CVE-2020-2138
Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
PT-2020-5085 · Jenkins · Jenkins Rapiddeploy Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins RapidDeploy Plugin versions 4.2 and earlier Description: The issue is related to the incorrect restriction of XML links to external objects, which can be exploited to perform an XML external entity XXE attack. This allows a remote...
XML External Entity (XXE)
AutoUpdater.NET is vulnerable to XML External Entity XXE. The vulnerability exists as the XML parser used in AutoUpdater does not properly restrict resolving XML external entities...
Security Bulletin: IBM Integration Bus and WebSphere Message Broker SOAP FLOWS are vulnerable to XML external entity attack (CVE-2016-9706)
Summary IBM Integration Bus and WebSphere Message Broker SOAP FLOWS are vulnerable to XML external entity attack. Vulnerability Details CVEID: CVE-2016-9706 DESCRIPTION: IBM Integration Bus and WebSphere Message Broker SOAP FLOWS are vulnerable to a denial of service attack, caused by an XML...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Message Broker and IBM Integration Bus
Summary Multiple security vulnerabilities exist in the IBM® Runtime Environment Java™ Technology Edition Version 6 Service Refresh 16 Fix Pack 41 and earlier releases used by WebSphere Message Broker, and the IBM® Runtime Environment Java™ Technology Edition Version 7 Service Refresh 10 Fix Pack ...
svglib package for Python code issue vulnerability
svglib package for Python is a Python library for reading and converting SVG files. A code issue vulnerability exists in svglib package 0.9.3 and earlier Python, which can be exploited by an attacker to conduct an XXE attack via a svg2rlg call...
PYSEC-2020-111
The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call...
pikachu
This is an offensive tool for Web application security testing. It is a web application that contains various web security vulnerabilities, including Burt Force brute-force, XSS cross-site scripting, CSRF cross-site request forgery, SQL-Inject SQL injection, RCE remote code execution, Files...