PT-2013-01: XML External Entity Injection in GNOME

Positive Research Center experts have detected a local resources access vulnerability files and internal network resources via XML External Entity enabled in GNOME. An attacker is able to give a user a specially crafted file. If he or she views a folder with the file or opens it, librsvg sends...

Debian Security Advisory DSA 2602-1 (zendframework - XML external entity inclusion)

Yury Dyachenko discovered that Zend Framework uses the PHP XML parser in an insecure way, allowing attackers to open files and trigger HTTP requests, potentially accessing restricted information. OpenVAS Vulnerability Test $Id: deb2602.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from...

PT-2013-1843

Name of the Vulnerable Software and Affected Versions IBM SPSS Modeler versions 14.0 through 14.2 FP3 IBM SPSS Modeler version 15.0 before FP2 Description The issue allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service du...

CVE-2012-5769: Undefined Security Weakness

IBM SPSS Modeler 14.0, 14.1, 14.2 through FP3, and 15.0 before FP2 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service CPU and memory consumption, via an XML external entity declaration in conjunction with an entity...

Potential XML eXternal Entity injection vectors in Zend Framework 1 Zend_Feed component

More info at https://framework.zend.com/security/advisory/ZF2012-05...

PT-2013-39: Improper Input Validation in Wonderware Information Server

Positive Research Center experts have discovered "Improper Input Validation" vulnerability in Wonderware Information Server. WIS allows access to local resources files and internal resources via unsafe parsing of XML external entities. By using specially crafted XML files, an attacker can cause W...

PT-2013-72: XML External Entities Resolution vulnerability in Microsoft Office Excel

The specialists of the Positive Research center have detected an XML External Entities Resolution vulnerability in Microsoft Office Excel. The vulnerability is possible due to unsafe parsing of XML external entities. If an attacker makes a victim open a specially crafted XML document, Microsoft...

Xxe

Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity XXE injection attack, as demonstrated by reading config.php...

CVE-2012-2239

Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity XXE injection attack, as demonstrated by reading config.php...

Xxe

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...

Xxe

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...

CVE-2011-5245

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...

PT-2012-2885 · Red Hat · Resteasy

Name of the Vulnerable Software and Affected Versions: RESTEasy versions prior to 2.3.1 Description: The issue allows remote attackers to read arbitrary files via an external entity reference in a DOM document, specifically through an XML external entity XXE injection attack. Recommendations: For...

PT-2013-36: XML External Entity Injection in Wonderware Win-XML Exporter

Positive Research Center experts have discovered "XML External Entity Injection" vulnerability in Wonderware Win-XML Exporter. If an attacker manages to make a victim open a project that contains specially crafted XML, Wonderware Win-XML Exporter will automatically send the contents of local or...

PT-2014-64: XML External Entity Injection in Yokogawa FAST/TOOLS

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in the Yokogawa FAST/TOOLS application. A local attacker can trick the WebHMI server into sending data to an outside computer. This vulnerability can also increase the load of the WebHMI...

Drupal OpenID External Entity Injection

This module abuses an XML External Entity Injection vulnerability on the OpenID module from Drupal. The vulnerability exists in the parsing of a malformed XRDS file coming from a malicious OpenID endpoint. This module has been tested successfully on Drupal 7.15 and 7.2 with the OpenID module...

FreeBSD : Zend Framework -- Multiple vulnerabilities via XXE injection (ec34d0c2-1799-11e2-b4ab-000c29033c32)

The Zend Framework team reports : The XmlRpc package of Zend Framework is vulnerable to XML eXternal Entity Injection attacks both server and client. The SimpleXMLElement class SimpleXML PHP extension is used in an insecure way to parse XML data. External entities can be specified by adding a...

CVE-2012-4399

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity XXE injection attack...

PT-2012-5373 · Cakephp · Cakephp

Name of the Vulnerable Software and Affected Versions: CakePHP versions 2.1.x through 2.1.4 CakePHP versions 2.2.x through 2.2.0 Description: The issue allows remote attackers to read arbitrary files via XML data containing external entity references, specifically through an XML external entity X...

CVE-2012-3489

The xmlparse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content tha...