7786 matches found
Design/Logic Flaw
An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...
PT-2022-28067 · Unknown · Xml-Rpc.Net
Name of the Vulnerable Software and Affected Versions: XML-RPC.NET versions prior to 2.5.0 Description: An XML external entity XXE injection issue allows remote authenticated users to conduct server-side request forgery SSRF attacks. This can be demonstrated by a "pingback.aspx" POST request...
CVE-2022-47514
An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...
3DCityDB Web Feature Service Interface 代码问题漏洞
3DCityDB Web Feature Service Interface is an open source city database WFS interface library for 3D City Database. 3DCityDB Web Feature Service Interface before 5.3.0 version of the code problematic vulnerability , the vulnerability stems from some unknown processing problems , which will lead to...
CVE-2022-4607 3D City Database OGC Web Feature Service xml external entity reference
A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
CVE-2022-25628
CVE-2022-25628 describes an XML External Entity (XXE) injection vulnerability in the Symantec Identity Manager 14.4 Management Console . An authenticated user can trigger XXE, with potential data exposure or other malicious activity as implied by the vulnerability class. The CVSS data from the en...
Symantec Identity Manager 代码问题漏洞
Symantec Identity Manager is an identity management system from Symantec Corporation. A security vulnerability exists in Symantec Identity Manager version 14.4, which originates from an authenticated user being able to perform XML external entity injection in the management console...
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
Adobe Experience Manager 6.5.0.0 < 6.5.15.0 Multiple Vulnerabilities (APSB22-59)
The version of Adobe Experience Manager installed on the remote host is prior to 6.5.15.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB22-59 advisory. - Adobe Experience Manager version 6.5.14 and earlier is affected by a reflected Cross-Site Scripting XSS...
Security Bulletin: IBM InfoSphere Information Server is vulnerable to an XML External Entity Injection (CVE-2022-40747)
Summary IBM InfoSphere Information Server is vulnerable to an XML External Entity Injection XXE Vulnerability Details CVEID:CVE-2022-40747 DESCRIPTION: IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker...
Security Bulletin: Apache POI up to 4.1.0 allows an attacker while converting user-provided document to XML
Summary In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker. Vulnerability Details CVEID:CVE-2019-12415 DESCRIPTION: Apache POI could allow a remote attacker to obtain sensitive...
The vulnerability of the dynamic data management framework Apache Calcite, related to incorrect restrictions on XML links to external objects, allows attackers to perform XXE attacks.
The vulnerability of the Apache Calcite dynamic data management framework is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks using specially created XML code...
CVE-2022-46827
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible...
JetBrains IntelliJ IDEA 代码问题漏洞
JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from the Czech company JetBrains. A security vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2022.3, which stems from an XXE attack that can be performed via a request to a custom plugi...
PT-2022-27984 · Jetbrains · Intellij Idea
Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.3 Description: The issue allows for an XXE attack, which can lead to a Server-Side Request Forgery SSRF via requests to custom plugin repositories. This occurs due to a flaw in handling requests ...
PT-2022-27946 · Jenkins · Jenkins Plot Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Plot Plugin versions 2.1.11 and earlier Description: The issue allows attackers who can control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of...