CVE-2023-49733

Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue...

CVE-2023-49733

CVE-2023-49733 affects Apache Cocoon 2.2.0 up to versions before 2.3.0. It is an XML External Entity (XXE) reference vulnerability due to improper restriction, enabling potentially sensitive data exposure and other impacts as described in the sources. The recommended remediations are upgrading to...

Apache Cocoon 代码问题漏洞

Apache Cocoon is the United States Apache Apache Foundation of a component-based Web development concepts built Web application framework. Apache Cocoon suffers from an XML External Entity Injection vulnerability that arises from a network system or product that does not have the correct filters ...

PT-2023-31314 · Apache +1 · Apache Tiles +1

Name of the Vulnerable Software and Affected Versions: Apache Tiles versions 2 onwards Description: The issue arises from the lack of validation of the value set as the DefaultLocaleResolver.LOCALE KEY attribute on the session while resolving XML definition files. This can lead to possible path...

PT-2023-31312 · Apache · Apache Cocoon

Name of the Vulnerable Software and Affected Versions: Apache Cocoon versions 2.2.0 through 2.2.x before 2.3.0 Apache Cocoon version 2.2.0 Description: The issue is related to an Improper Restriction of XML External Entity Reference, which allows users to inject malicious code into XML documents...

PT-2023-31280 · Jenkins · Jenkins Matlab Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MATLAB Plugin versions 2.11.0 and earlier Description: The issue arises from missing permission checks in the Jenkins MATLAB Plugin, allowing attackers to have Jenkins parse an XML file from the Jenkins controller file system...

Jenkins MATLAB Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to server-side request forgery due to Eclipse Jetty (261776)

Summary IBM Sterling Connect:Direct Browser User Interface uses Eclipse Jetty server. Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. By...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to server-side request forgery due to Eclipse Jetty (261776)

Summary IBM Sterling Connect:Direct Web Services uses Eclipse Jetty. Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. By sending a specially...

XML External Entity (XXE)

svgoptimizer is vulnerable to XML external entity XXE . The vulnerability exists due to allowing XXE by default in svgoptimizer.rb which could allow an attacker to escalate privileges...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to multiple vulnerabilities due to Jetty

Summary IBM Sterling Connect:Direct Browser User Interface uses Jetty server. Vulnerability Details IBM X-Force ID: 260681 DESCRIPTION: Eclipse Jetty is vulnerable to an XML external entity injection XXE attack when processing XML data, caused by a weakly configured XML parser. By using specially...

Adobe RoboHelp Server < 11.5 Multiple Vulnerabilities (APSB23-53)

Adobe RoboHelp Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:robohelpserver"...

Adobe RoboHelp Server < 11 Update 5 Multiple Vulnerabilities (APSB23-53)

The version of Adobe RoboHelp Server installed on the remote host is prior to 11 Update 5. It is, therefore affected by multiple vulnerabilities: - XML external entity XXE vulnerability. CVE-2023-22274 - Information disclosure due to a memory leak. CVE-2023-22272 - Path traversal vulnerability...

VulnCheck KEV: CVE-2022-2414

Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...

Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe RoboHelp Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UpdateCommandStream method. Due to the improper restriction of XML...

CVE-2023-46590

A vulnerability has been identified in Siemens OPC UA Modelling Editor SiOME All versions V2.8. Affected products suffer from a XML external entity XXE injection vulnerability. This vulnerability could allow an attacker to interfere with an application's processing of XML data and read arbitrary...

CVE-2023-46590

A vulnerability has been identified in Siemens OPC UA Modelling Editor SiOME All versions V2.8. Affected products suffer from a XML external entity XXE injection vulnerability. This vulnerability could allow an attacker to interfere with an application's processing of XML data and read arbitrary...

CVE-2023-46590

A vulnerability has been identified in Siemens OPC UA Modelling Editor SiOME All versions V2.8. Affected products suffer from a XML external entity XXE injection vulnerability. This vulnerability could allow an attacker to interfere with an application's processing of XML data and read arbitrary...

NI DIAdem GPX File Parsing XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NI DIAdem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing o...

PT-2023-7076 · Adobe · Robohelp Server

Name of the Vulnerable Software and Affected Versions: Adobe RoboHelp Server versions 11.4 and earlier Description: The issue is related to an Improper Restriction of XML External Entity Reference 'XXE' vulnerability. This could lead to information disclosure by an unauthenticated attacker...