CVE-2022-41967 Improper Restriction of XML External Entity Reference in Dragonfly

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity XXE attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML SNAPSHOT versions are being resolved...

CVE-2022-41967 Improper Restriction of XML External Entity Reference in Dragonfly

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity XXE attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML SNAPSHOT versions are being resolved...

PT-2022-26190 · Dragonfly · Dragonfly

Name of the Vulnerable Software and Affected Versions: Dragonfly version 0.3.0-SNAPSHOT Description: The issue concerns a Java runtime dependency management library that does not configure DocumentBuilderFactory to prevent XML external entity XXE attacks. This can be avoided by not trying to...

CVE-2022-4607

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

CVE-2022-4607

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

Xxe

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

CVE-2022-47514

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

Design/Logic Flaw

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

CVE-2022-47514

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

PT-2022-28067 · Unknown · Xml-Rpc.Net

Name of the Vulnerable Software and Affected Versions: XML-RPC.NET versions prior to 2.5.0 Description: An XML external entity XXE injection issue allows remote authenticated users to conduct server-side request forgery SSRF attacks. This can be demonstrated by a "pingback.aspx" POST request...

3DCityDB Web Feature Service Interface 代码问题漏洞

3DCityDB Web Feature Service Interface is an open source city database WFS interface library for 3D City Database. 3DCityDB Web Feature Service Interface before 5.3.0 version of the code problematic vulnerability , the vulnerability stems from some unknown processing problems , which will lead to...

CVE-2022-4607 3D City Database OGC Web Feature Service xml external entity reference

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

CVE-2022-25628

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...

CVE-2022-25628

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...

CVE-2022-25628

CVE-2022-25628 describes an XML External Entity (XXE) injection vulnerability in the Symantec Identity Manager 14.4 Management Console . An authenticated user can trigger XXE, with potential data exposure or other malicious activity as implied by the vulnerability class. The CVSS data from the en...

Symantec Identity Manager 代码问题漏洞

Symantec Identity Manager is an identity management system from Symantec Corporation. A security vulnerability exists in Symantec Identity Manager version 14.4, which originates from an authenticated user being able to perform XML external entity injection in the management console...

CVE-2022-25628

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...

Adobe Experience Manager 6.5.0.0 < 6.5.15.0 Multiple Vulnerabilities (APSB22-59)

The version of Adobe Experience Manager installed on the remote host is prior to 6.5.15.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB22-59 advisory. - Adobe Experience Manager version 6.5.14 and earlier is affected by a reflected Cross-Site Scripting XSS...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to an XML External Entity Injection (CVE-2022-40747)

Summary IBM InfoSphere Information Server is vulnerable to an XML External Entity Injection XXE Vulnerability Details CVEID:CVE-2022-40747 DESCRIPTION: IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker...

Security Bulletin: Apache POI up to 4.1.0 allows an attacker while converting user-provided document to XML

Summary In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker​​. Vulnerability Details CVEID:CVE-2019-12415 DESCRIPTION: Apache POI could allow a remote attacker to obtain sensitive...