XML External Entity (XXE) Injection

Overview nokogiri is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors. Affected versions of this Gem are vulnerable to XML External Entity XXE attacks. Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, which are librari...

XML External Entity (XXE)

hbase-rest is vulnerable to XML External Entity XXE injection. This is possible because it does not block external entities from being parsed...

ForgeRock OpenAM - Access Management XML External Entity Injection Vulnerability

ForgeRock OpenAM - Access Management is the United States ForgeRock company's set of open source single sign-on framework SSO, which provides a core identity services Core Server to achieve a transparent single sign-on in a network architecture such as centralized, distributed single sign-on. An...

IBM License Metric Tool and BigFix Inventory XML External Entity Injection Vulnerability

The IBM License Metric Tool and BigFix Inventory are both products of IBM Corporation of America. The former is a set of free tools that help IBM Passport Advantage Software Upgrade and Support Services customers determine their Processor Value Unit PVU licensing needs, and the latter is a soluti...

Xxe

XML External Entity XXE Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter...

CVE-2016-10097

XML External Entity XXE Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter...

CVE-2016-7458

VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Xxe

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity...

CVE-2016-7460

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity...

CVE-2016-7459

VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a 1 Log Browser, 2 Distributed Switch setup, or 3 Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML...

CVE-2016-7459

Summary of CVE-2016-7459 and related XXE family (VMware VMSA-2016-0022) : VMware vCenter Server versions 5.5 prior to U3e and 6.0 prior to U2a are affected by XML External Entity (XXE) vulnerabilities in the Log Browser, Distributed Switch setup, and Content Library. The root cause is incorrectly...

CVE-2016-7459

VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a 1 Log Browser, 2 Distributed Switch setup, or 3 Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML...

CVE-2016-7458

VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2016-5851

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

CVE-2016-5851

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

PYSEC-2016-21

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

PYSEC-2016-21

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

PT-2016-6716 · Python · Python-Docx

Name of the Vulnerable Software and Affected Versions: python-docx versions prior to 0.8.6 Description: The issue allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document. This can be exploited by providing a specially crafted document to the python-doc...

F5 Networks BIG-IP : libxml2 vulnerabilities (K24322529)

CVE-2016-4447 The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service heap-based buffer underread and application crash via a crafted file, involving xmlParseName. CVE-2016-4449 XML external entity XXE vulnerability in t...

libxml2: Inappropriate fetch of entities content

XML external entity XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service resource consumption via unspecified vectors...