CVE-2019-12415

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing...

CVE-2019-12415

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing...

CVE-2019-12415

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing...

CVE-2019-10466

An XML external entities XXE vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks...

CVE-2019-14276

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

PT-2019-11860 · Jenkins · Jenkins 360 Fireline Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins 360 FireLine Plugin affected versions not specified Description: The issue is related to an XML external entities XXE vulnerability, which allows attackers with Overall/Read access to have Jenkins resolve external entities. This can...

PT-2019-13578 · Wustl · Xnat

Name of the Vulnerable Software and Affected Versions: WUSTL XNAT version 1.7.5.3 Description: The issue allows XXE attacks via a POST request body. Recommendations: For version 1.7.5.3, update to a newer version that contains a fix for this issue...

Apache POI CVE-2019-12415 XML External Entity Information Disclosure Vulnerability

Description Apache POI is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. Apache POI version 4.1.0 and prior are vulnerable. Technologies Affected Apache POI 0.1 Apache POI 0.10.0 Apache...

XML External Entity

Overview Affected versions of this package are vulnerable to XML External Entity. The XmlScanner decodes the sheet1.xml from an .xlsx to UTF-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By...

XML External Entity (XXE)

Raml parser is vulnerable to XML external entity attacks. The attack is possible because an XML input containing a reference to an external entity is not blocked by the XML parser, allowing an attacker to inject malicious XML files to retrieve system files or perform requests on behalf of the...

Dell EMC RSA Authentication Manager XML External Entity Information Disclosure Vulnerability

Description Dell EMC RSA Authentication Manager is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. Dell RSA Authentication Manager version 8.4 P6 and prior are vulnerable. Technologies...

Adobe Experience Manager XML External Entity Injection Vulnerability (CNVD-2019-37124)

Adobe Experience Manager is an enterprise content management solution that helps you simplify the management and delivery of your content and assets. An XML external entity injection vulnerability exists in Adobe Experience Manager 6.0, 6.1, 6.2, 6.3, 6.4, 6.5. An attacker can exploit this...

SAP Enable Now Input Validation Error Vulnerability (CNVD-2020-04335)

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning and training in SAP and non-SAP systems. An input validation error vulnerability exists in SAP Enable Now. The vulnerability originates from a network system...

Cisco Unified Communications Manager WEB Interface XXE Attack Vulnerability

Cisco Unified Communications Manager is a unified communications solution. An XXE attack vulnerability exists in the Cisco Unified Communications Manager WEB interface, which allows remote attackers to exploit the vulnerability by submitting a specially crafted XML request, which can be used to...

XML External Entity (XXE)

DiffPlug Spotless is vulnerable to XML external entities XXE. The XML formatter has resolveExternalURI setting to true by default and it loads external DTD...

Security Bulletin: IBM Security Access Manager for Enterprise Single-Sign On is affected by an XML External Entity Injection (XXE) vulnerability (CVE-2019-4513)

Summary IBM Security Access Manager for Enterprise Single-Sign On has addressed the following vulnerability: XML External Entity Injection XXE attack when processing XML data. Vulnerability Details CVEID: CVE-2019-4513 DESCRIPTION: IBM Security Access Manager for Enterprise Single-Sign On is...

XML External Entity (XXE)

selenium-firefox-driver is vulnerable to XML external entity attacks. External DTD declarations are not disabled, allowing a remote attacker to perform server-side request forgery attacks, local port scanning, access system files and possibly a denial of service attack...

CVE-2019-16188

HCL AppScan Source before 9.03.13 is susceptible to XML External Entity XXE attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the conte...

Xxe

HCL AppScan Source before 9.03.13 is susceptible to XML External Entity XXE attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the conte...

CVE-2019-16188

The CVE-2019-16188 issue affects HCL AppScan Source prior to version 9.03.13. It allows XML External Entity (XXE) attacks via a specially crafted .ozasmt file, where, if the victim opens/imports it, the attacker can read local files accessible to the victim and exfiltrate content to a remote list...