expat -- multiple vulnerabilities

Mitre reports: An integer overflow during the parsing of XML using the Expat library. XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD...

IBM WebSphere Application Server 7.0 < 7.0.0.39 Multiple Vulnerabilities (FREAK)

Binary data 9700.prm...

Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection

Exploit Title: Oracle BI Publisher formerly XML Publisher - XML External Entity Injection w/o authentication Date: 20\10\2016 Exploit Author: Jakub Palaczynski CVE : CVE-2016-3473 Vendor Homepage: https://www.oracle.com/ Version: 11.1.1.6.0, 11.1.1.7.0, 11.1.1.9.0, 12.2.1.0.0 Info: Previous...

Oracle BI Publisher 11.1.1.6.011.1.1.7.011.1.1.9.012.2.1.0.0 - XML External Entity Injection

Oracle BI Publisher 11.1.1.6.011.1.1.7.011.1.1.9.012.2.1.0.0 - XML External Entity Injection Exploit Title: Oracle BI Publisher formerly XML Publisher - XML External Entity Injection w/o authentication Date: 20\10\2016 Exploit Author: Jakub Palaczynski CVE : CVE-2016-3473 Vendor Homepage:...

Juniper Junos Space XML External Entity Injection Vulnerability

Juniper Junos Space is a network management solution from Juniper Networks. The solution supports automated configuration, monitoring and troubleshooting of devices and services throughout their lifecycle. An XML external entity injection vulnerability exists in Juniper Junos Space versions prior...

IBM Tivoli Endpoint Manager XML External Entity Injection Vulnerability

IBM Tivoli Endpoint Manager is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

RSA Enterprise Compromise Assessment Tool 4.1.0.1 - XML External Entity Injection

Exploit for multiple platform in category local exploits title: XML External Entity Injection XXE product: RSA Enterprise Compromise Assessment Tool ECAT vulnerable version: 4.1.0.1 fixed version: 4.1.2.0 CVE Number: - impact: Medium homepage: https://www.rsa.com found: 2016-04-27 by: Samandeep...

RSA Enterprise Compromise Assessment Tool (ECAT) 4.1.0.1 XXE Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XML External Entity Injection XXE product: RSA Enterprise Compromise Assessment Tool ECAT vulnerable version: 4.1.0.1 fixed version: 4.1.2.0 CVE Number: - impact: Medium...

WSO2 Identity Server CSRF And XXE Vulnerabilities

WSO2 Identity Server is prone to a XML external entity XXE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-1832

XML external entity XXE vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service resource consumption via vectors involving XmlVTI and the XML dataty...

UBUNTU-CVE-2015-1832

XML external entity XXE vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service resource consumption via vectors involving XmlVTI and the XML dataty...

CVE-2016-5971

IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference,...

CVE-2016-5971

IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference,...

CVE-2016-6408

Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCvb17814...

CVE-2016-6408

Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCvb17814...

Cisco Prime Home XML External Entity Injection Vulnerability

Cisco Prime Home is a standards-based remote management and configuration solution. An XML external entity injection vulnerability exists in the Web-Based user interface of Cisco Prime Home version 5.2.0. A remote attacker could exploit this vulnerability by sending a specially crafted XML file t...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the...

XXE Vulnerability in Ninth OA System

Ninth OA system is the OA system to install, implement, learn, operate and maintain. Ninth OA system DocumentBuilder db = ex.newDocumentBuilder; Document doc = db.parserequest.getInputStream; XXE vulnerability exists. An attacker can read arbitrary files on the server and obtain sensitive...

PT-2016-20: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "FloorPlanApp" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. How to...

PT-2016-22: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the GPL hidden content validation component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML...