Cisco Unified MeetingPlace XML Processing Information Disclosure Vulnerability

A vulnerability in the web-based user interface of Cisco Unified MeetingPlace could allow an authenticated, remote attacker to gain read access to select information stored on the affected system. The vulnerability is due to improper handling of XML External Entities XXEs when parsing an XML file...

CVE-2015-1833

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...

SAP NetWeaver AS Java XML External Entity Vulnerability

SAP NetWeaver is SAP's software base platform, divided into SAP Netweaver JAVA and Netweaver ABAP. Its predecessor is SAP BASIS components. Because of the development of the Internet and JAVA, SAP adjusted the architecture of the basic platform, adding support for JAVA, but also to enhance the...

Debian DLA-229-1 : libnokogiri-ruby security update

An XML eXternal Entity XXE flaw was found in Nokogiri, a Ruby gem for parsing HTML, XML, and SAX. Using external XML entities, a remote attacker could specify a URL in a specially crafted XML that, when parsed, would cause a connection to that URL to be opened. This update enables the 'nonet'...

Xxe

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

CVE-2015-4091

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

Hikvision DS-7108HWI-SH XML External Entity Injection Vulnerability

Hikvision DS-7108HWI-SH is a digital video recorder product from Hikvision. An XML external entity injection vulnerability exists in the Hikvision DS-7108HWI-SH, which allows an attacker to exploit the vulnerability to obtain sensitive information or conduct denial-of-service attacks via special...

CVE-2015-4091: Undefined Security Weakness

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

APPLE-SA-2015-05-19-1 Watch OS 1.0.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-05-19-1 Watch OS 1.0.1 Watch OS 1.0.1 is now available and addresses the following: Certificate Trust Policy Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: Update to the certificate trust policy Descriptio...

CVE-2014-8924

The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity...

Debian Security Advisory DSA 3265-1 (zendframework - security update)

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework. Except for CVE-2015-3154 , all these issues were already fixed in the version initially shipped with Jessie. CVE-2014-2681Lukas Reschke reported a lack of protection against XML External Entity injection attacks in some...

DSA-3265-1 zendframework - security update

Bulletin has no description...

Huawei SEQ Analyst XML External Entity Vulnerability

Huawei SEQ Analyst is Huawei's platform for monitoring service quality and managing relationships between individual users and multiple suppliers. The platform provides functions such as service debugging, user complaint handling, troubleshooting, user experience management, and deployment of...

Spacewalk and Red Hat Network (RHN) Satellite XXE Attack File Read Vulnerability

Spacewalk is a system management solution for Linux and Solaris.Red Hat Network Satellite is a system management tool based on the Linux architecture. An XML external entity vulnerability exists in the Spacewalk and Red Hat Network RHN Satellite RPC interface, which could be exploited by a remote...

Xxe

XML external entity XXE vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter...

RESTEasy: XXE via parameter entities

It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible...

apache-poi: XML eXternal Entity (XXE) flaw

It was found that Apache POI would resolve entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to read files accessible to the user running the application server, and potentially perform more advanced XML External Entity...

Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs

It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities XXEs in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive informati...

PT-2015-4022 · Red Hat · Red Hat Network Satellite +1

Name of the Vulnerable Software and Affected Versions: Red Hat Network Satellite versions 5.7 and earlier Spacewalk versions 5.7 and earlier Description: The issue is related to an XML external entity XXE in the RPC interface. This allows remote attackers to read arbitrary files and possibly have...

Adobe Acrobat < 10.1.14 / 11.0.11 Multiple Vulnerabilities (APSB15-10)

The version of Adobe Acrobat installed on the remote host is a version prior to 10.1.14 / 11.0.11. It is, therefore, affected by the following vulnerabilities : - A buffer overflow condition exists in CoolType.dll due to improper validation of user-supplied input. A remote attacker can exploit th...