7786 matches found
CVE-2022-45326
An XML external entity XXE injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery SSRF attacks...
Design/Logic Flaw
An XML external entity XXE injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery SSRF attacks...
CVE-2022-45326
An XML external entity XXE injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery SSRF attacks...
PT-2022-27466 · Kwoksys · Kwok Information Server
Name of the Vulnerable Software and Affected Versions: Kwoksys Kwok Information Server versions prior to 2.9.5.SP31 Description: An XML external entity XXE injection issue allows remote authenticated users to conduct server-side request forgery SSRF attacks. This enables attackers to manipulate t...
ManageEngine ServiceDesk Plus MSP < 13.0 Build 13001 XXE
An XML external entity XXE vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 Build 13001 due to a flaw in the Analytics Plus integration. Threat actors with admin role access can retrieve local files from the server running the affected products. Note that Nessus has not...
ManageEngine AssetExplorer 6.9 Build 6980 XXE
An XML external entity XXE vulnerability exists in ManageEngine AssetExplorer 6.9 Build 6980 due to a flaw in the Analytics Plus integration. Threat actors with admin role access can retrieve local files from the server running the affected products. Note that Nessus has not tested for this issue...
ManageEngine SupportCenter Plus < 11.0 Build 11026 Multiple Vulnerabilities
The version of ManageEngine SupportCenter Plus prior to 11.0 Build 11026 is running on the remote web server. It is, therefore, affected by multiple vulnerabilities, including the following: - A remote code execution vulnerability due to a flaw in the Analytics Plus integration input field...
codehaus-plexus 代码问题漏洞
codehaus-plexus is codehaus-plexus open source a collection of various utility classes . It can easily handle strings, files, command lines, XML, and more. codehaus-plexus has a security vulnerability that stems from XML External Entity XXE injection...
CVE-2022-40771
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure...
Xxe
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure...
CVE-2022-40771
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure...
CVE-2022-40771
CVE-2022-40771 affects Zoho ManageEngine ServiceDesk Plus versions 13010 and earlier. The vulnerability is an XML External Entity (XXE) issue in the Analytics Plus integration that can lead to information disclosure. The CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N with a base score of...
CVE-2022-40771
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure...
PT-2022-25530 · Zoho · Manageengine Servicedesk Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior Description: The issue is related to an XML External Entity attack, which leads to Information Disclosure. This attack can potentially expose sensitive information. Recommendations:...
Information Disclosure
pki-core is vulnerable to Information Disclosure. An attacker is able to retrieve the content of arbitrary files by sending specially crafted HTTP requests causing xml external entity attacks...
DEBIAN-CVE-2022-44641
In Linaro Automated Validation Architecture LAVA before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service...
CVE-2022-3980
An XML External Entity XEE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4...
XML External Entity Reference in Jenkins Violations Plugin
Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers to control XML input files for the 'Report Violations' post-build step to have agent processes parse a crafted file that uses external entities for extraction o...
XML External Entity (XXE)
Concrete CMS is vulnerable to XML external entity. The vulnerability exists in dataToXml function in Sanitizer.php, which allows an attacker to inject and execute malicious code into the system due to improper sanitization of SVGs, leading to IP disclosure...