CVE-2011-0212

CVE-2011-0212 affects Apple Mac OS X Server (servermgrd) prior to 10.6.8. An XML External Entity (XXE) flaw in servermgrd’s XML-RPC handling can allow remote attackers to read arbitrary files and potentially send HTTP requests to intranet servers, with possible CPU/memory DoS. Root cause: unsafe ...

CVE-2011-2206

CVE-2011-2206 affects DJabberd up to version 0.84 via DJabberd’s XMLParser.pm. It allows remote authenticated users to read arbitrary files and potentially contact intranet hosts or trigger denial of service through XML external entities with nested references. The description indicates the issue...

CVE-2011-2206

XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service CPU and memory consumption, via an XML external entity declaration in conjunction with an entity reference, a different...

PT-2011-3682

Name of the Vulnerable Software and Affected Versions DJabberd versions prior to 0.85 Description The issue allows remote authenticated users to read arbitrary files and possibly send HTTP requests to intranet servers or cause a denial of service due to CPU and memory consumption. This is achieve...

CVE-2011-2206: Undefined Security Weakness

XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service CPU and memory consumption, via an XML external entity declaration in conjunction with an entity reference, a different...

CVE-2011-1280: Exposure of Sensitive Information to an Unauthorized Actor

The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express SSMSE 2005; and Visual Studio 2005 SP1, 2008 SP1, and 2010 does not properly handle external entities, which allows remote attackers to read arbitrar...

SAP NetWeaver BW - XML External Entity

Application: SAP BW Versions Affected: SAP BASIS 6.40/7.02 maybe others Vendor URL: http://www.sap.com Bugs:XML External Entity Exploits: YES Reported: 13.05.2011 Vendor response: 14.05.2011 Date of Public Advisory: 30.06.2012 Reference: SAP Security Note 1597066 Author: Alexey Tyurin ERPScan...

Design/Logic Flaw

Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity aka XXE issue...

CVE-2011-1502

Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity aka XXE issue...

CVE-2011-1502

CVE-2011-1502 affects Liferay Portal Community Edition 6.x up to 6.0.6 GA when deployed with Apache Tomcat. The vulnerability stems from an XML External Entity (XXE) issue: remote authenticated users can read arbitrary files by abusing an entity declaration with an entity reference. The available...

CVE-2011-1502

Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity aka XXE issue...

Ektron CMS400.net TransformXslt Web Service Directory Traversal

The installed version of Ektron CMS400.net ships with a web service that processes untrusted XML data and could allow an attacker to perform XML External Entity XXE attacks. Nessus was able to exploit this issue by sending a specially crafted request to the 'TransformXslt' web service, and retrie...

Adobe multiple server application information leak

It's possible to access loca files by AMFX request with XML External Entities...

Adobe Products XML External Entity And XML Injection

, , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Multiple Adobe Products XML External Entity And XML Injection Vulnerabilities CVE: CVE-2009-3960 Adobe PSIRT: APSB10-05 -...

Adobe (Multiple Products) - XML External Entity XML Injection

Adobe Multiple Products - XML External Entity XML Injection , , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Multiple Adobe Products XML External Entity And XML Injection Vulnerabilities CVE:...

Adobe Products XML External Entity And XML Injection Vulnerabilities

Exploit for unknown platform in category dos / poc ==================================================================== Adobe Products XML External Entity And XML Injection Vulnerabilities ==================================================================== Multiple Adobe Products XML External...

PT-2010-1185

Name of the Vulnerable Software and Affected Versions BlazeDS versions 3.2 and earlier LiveCycle versions 8.0.1, 8.2.1, and 9.0 LiveCycle Data Services versions 2.5.1, 2.6.1, and 3.0 Flex Data Services version 2.0.1 ColdFusion versions 7.0.2, 8.0, 8.0.1, and 9.0 Description The issue allows remot...

Design/Logic Flaw

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a...

CVE-2009-1699

The CVE-2009-1699 entry is confirmed in connected documents as a WebKit XXE vulnerability: qt4-x11 uses WebKit’s XSL stylesheet processing and does not properly handle XML external entities, enabling remote file disclosure via a crafted DTD (e.g., file:///… paths). Affected product/kit: Qt4-x11 w...

CVE-2009-1699

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a...