456 matches found
CVE-2014-8655
The Compal Broadband Networks CBN CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to bypass authentication and obtain sensitive information via an a admin or a b root value in the userData cookie in a request to 1 CmgwWirelessSecurity.xml, 2...
Mandriva Linux Security Advisory : libxml2 (MDVSA-2014:204)
A vulnerability has been found and corrected in libxml2 : A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, wou...
Updated libxml2 packages fix security vulnerability
A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption denial of service bas...
Moderate: Red Hat Security Advisory: libxml2 security update
Updated libxml2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...
tomcat: information disclosure via XXE when running untrusted web applications
It was found that several application-provided XML files, such as web.xml, content.xml, .tld, .tagx, and .jspx, resolved external entities, permitting XML External Entity XXE attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictio...
tomcat: information disclosure via XXE when running untrusted web applications
It was found that several application-provided XML files, such as web.xml, content.xml, .tld, .tagx, and .jspx, resolved external entities, permitting XML External Entity XXE attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictio...
CVE-2014-4689
Absolute path traversal vulnerability in pkgedit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter...
Path traversal
Absolute path traversal vulnerability in pkgedit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter...
CVE-2014-4689
CVE-2014-4689 affects pfSense before version 2.1.4. The vulnerability is an absolute path traversal in the web interface’s pkg_edit.php, allowing remote attackers to read arbitrary XML files by supplying a full pathname in the xml parameter. The issue is rooted in improper validation of the input...
CVE-2014-4689
Absolute path traversal vulnerability in pkgedit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter...
OracleAS TopLink Mapping Workbench Weak Encryption Algorithm Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9515/info OracleAS TopLink Mapping Workbench is a tool included with OracleAS TopLink, a Java-based database integration development framework that is included as a component of various Oracle Application Server releases...
GetSimple CMS 2.01 and 2.02 Administrative Credentials Disclosure
No description provided by source. Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548...
WebSiteSniffer v1.41 - Captures all Web site files downloaded by your Web browser while browsing the Internet
WebSiteSniffer is a packet sniffer tool that captures all Web site files downloaded by your Web browser while browsing the Internet, and stores them on your hard drive under the base folder that you choose. WebSiteSniffer allows you to choose which type of Web site files will be captured: HTML...
openSUSE Security Update : libxml2 (openSUSE-SU-2011:0839-1)
Specially crafted xml files could crash applications using libxml2 CVE-2011-1944. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libxml2-4811. The text description of this plugin is C SUSE LL...
openSUSE Security Update : libxml2 (openSUSE-SU-2011:0839-1)
Specially crafted xml files could crash applications using libxml2 CVE-2011-1944. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libxml2-4811. The text description of this plugin is C SUSE LL...
openSUSE Security Update : git-web (openSUSE-SU-2011:0705-1)
Users with commit access to repos served by git-web could cause cross site scripting XSS issues with XML files CVE-2011-2186. Due to a differently formatted /etc/mime.types openSUSE is not affected by default. This update nevertheless turns on git-web's XSS protection mechanism to avoid similar...
CA ERwin Web Portal ConfigServiceProvider Information Disclosure (CVE-2014-2210)
An information disclosure vulnerability exists in CA ERwin Web Portal. Upon executing a successful attack, the server will give access to XML files which normally should not be accessible to external users. This vulnerability is due to lack of authentication and insufficient input validation in t...
[oss-security] CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled
Hi, It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substituton in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file...
CA ERwin Web Portal MIMM ConfigServiceProvider Information Disclosure Vulnerability
This vulnerability allows remote attackers to read database credentials on a system with vulnerable installations of CA ERwin Web Portal's Meta Integration Metadata Management service. Authentication is not required to exploit this vulnerability. The specific flaw exists within the "Meta...
CA ERwin Web Portal MIMM ConfigServiceProviderServlet Remote File Creation/Overwrite Vulnerability
This vulnerability allows remote attackers to overwrite arbitrary .xml files on a system with vulnerable installations of CA ERwin Web Portal's Meta Integration Metadata Management service. Authentication is not required to exploit this vulnerability. The specific flaw exists within the "Meta...