551 matches found
CVE-2017-1000061
xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...
CVE-2017-1000061
xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...
Spoofed Server Attacks
cxf-rt-rs-security-xml is vulnerable to server spoofing attacks. The attacks are possible because the XML security clients fail to validate whether the JAX-RS service response is signed or encrypted...
Code injection
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...
CVE-2017-5653
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...
CVE-2017-5653: Improper Certificate Validation
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...
PT-2017-16647
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.1.11 Apache CXF versions prior to 3.0.13 Description The issue concerns the JAX-RS XML Security streaming clients in Apache CXF, where the service response is not validated for a signature or encryption. This...
Bypass XML Signature Protection Mechanism
Apache Santuario XML Security is vulnerable to bypass attacks. Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows malicious users to remotely bypass the streaming XML signature protection mechanism. It does not affect versions 1.4.x or 1.5.x...
XMLSec Libxml2 XXE Vulnerability
XMLSec is a C-based library for implementing the XML security standard. libxml2 is a C-based library for parsing XML documents developed by the GNOME project. A security vulnerability exists in XMLSec 1.2.23 and earlier and Libxml2 2.9.4 and earlier used in other products. The vulnerability can b...
Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information
The multiple vulnerabilities in the xml-security-c package of the Debian GNU/Linux operating system can be exploited, leading to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...
OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)
It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory...
PT-2015-6789
Name of the Vulnerable Software and Affected Versions ZendXml versions prior to 1.0.1 Zend Framework versions prior to 1.12.14 Zend Framework 2.x versions prior to 2.4.6 Zend Framework 2.5.x versions prior to 2.5.2 Description The issue allows remote attackers to bypass security checks and conduc...
Debian DLA-85-1 : libxml-security-java security update
James Forshaw discovered that, in Apache Santuario XML Security for Java, CanonicalizationMethod parameters were incorrectly validated: by specifying an arbitrary weak canonicalization algorithm, an attacker could spoof XML signatures. NOTE: Tenable Network Security has extracted the preceding...
RESTeasy: External entities expanded by DocumentProvider
It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessibl...
CVE-2014-8152
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document...
Authentication flaw
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document...
CVE-2014-8152
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document...
CVE-2014-8152
CVE-2014-8152 affects Apache Santuario XML Security for Java 2.0.x prior to 2.0.3. The vulnerability arises from improper handling in the streaming XML Signature verification, allowing a remote attacker to bypass the streaming XML signature protection mechanism and potentially modify a crafted XM...
