CVE-2018-1730

IBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 147709...

Security Bulletin: IBM QRadar SIEM is vulnerable to XML External Entity Injection (CVE-2018-1730)

Summary The product does not disable external XML Entity Processsing which can lead to information disclosure and denial of service attacks. Vulnerability Details CVEID: CVE-2018-1730 Description: IBM QRadar is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A...

IBM QRadar SIEM XML External Entity Injection Vulnerability (CNVD-2018-24553)

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. An XML external...

PhpSpreadsheet < 1.5.0 - XML External Entity (XXE)

Product Description PhpSpreadsheet is a library written in pure PHP that provides a set of classes allowing users to read from and write to different spreadsheet file formats, such as Excel and LibreOffice Calc. Vulnerabilities List One vulnerability was identified within the PhpSpreadsheet...

Security Bulletin: Multiple Vulnerabilities in WebSphere Application Server bundled with IBM WebSphere Application Server Patterns

Summary WebSphere Application Server is shipped as a component of IBM WebSphere Application Server Patterns. Information about security vulnerabilities affecting WebSphere Application Server have been published in multiple security bulletins. Vulnerability Details Please consult the following...

IBM WebSphere Application ServerXML External Entity Injection Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. An XML external entity injection vulnerability exists in IBM...

SAP NetWeaver Knowledge Management (XMLForms) XML External Entity Injection Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications. An XML external entity injection vulnerability exists in Knowledge Management XMLForms in SAP NetWeaver, which can be exploited by an attacker to gain...

XML External Entity (XXE)

processing is vulnerable to an XML External Entity XXE attack. The library does not disable external Document-Type Declarations, allowing a malicious user to conduct XXE attacks...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection. phpoffice/phpspreadsheet is a library written in pure PHP and providing a set of classes that allow you to read from and to write to different spreadsheet file formats, like Excel and LibreOffice Calc...

Xxe

An XML External Entity XXE vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an attacker, an intranet network may be accessed and information may be leaked...

CVE-2018-19244

An XML External Entity XXE vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an attacker, an intranet network may be accessed and information may be leaked...

CVE-2018-19244

An XML External Entity XXE vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an attacker, an intranet network may be accessed and information may be leaked...

TufinOS 2.17 Build 1193 - XML External Entity Injection

TufinOS 2.17 Build 1193 - XML External Entity Injection Exploit Title: TufinOS 2.17 Build 1193 - XML External Entity Injection Exploit Author: konstantinos Alexiou Date: 2018-10-18 Vendor: https://www.tufin.com Software Link: https://www.tufin.com/tufin-orchestration-suite/securetrack CVE: N/A...

TufinOS 2.17 Build 1193 - XML External Entity Injection Vulnerability

Exploit for linux platform in category web applications Exploit Title: TufinOS 2.17 Build 1193 - XML External Entity Injection Exploit Author: konstantinos Alexiou Vendor: https://www.tufin.com Software Link: https://www.tufin.com/tufin-orchestration-suite/securetrack CVE: N/A Category: webapps 1...

The vulnerability of Microsoft SQL Server Management Studio’s database management tool lies in the insufficient restriction on XML references to external objects, which allows attackers to exploit this to disclose sensitive information.

The vulnerability of the Microsoft SQL Server Management Studio SSMS database management tool is related to insufficient restrictions on XML references to external objects XML External Entity, XXE. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information using a...

CVE-2018-15444 Cisco Energy Management Suite XML External Entity Vulnerability

A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entri...

Apache Syncope XML External Entity Injection Vulnerability

Apache Syncope is an open source system for managing digital identities in enterprise environments, implemented using Java EE technology and released under the Apache 2.0 license. Apache Syncope suffers from an XML external entity injection vulnerability. An administrator with workflow definition...

GHSA-QFJV-998W-Q48F Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution...

Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution...

CVE-2018-18980

An XML External Entity injection XXE vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrar...