CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain...

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain...

Multiple security vulnerabilities in ZOHO ManageEngine products

ZOHO ManageEngine ADAudit Plus and ZOHO ManageEngine Access Manager Plus are both products of ZOHO, Inc. ZOHO ManageEngine ADAudit Plus is designed to simplify auditing, prove compliance and detect threats. zoho ManageEngine Access Manager Plus is a privileged session management solution for...

CVE-2022-47966: Improper Input Validation

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain...

CVE-2022-47966

CVE-2022-47966 (ManageEngine products) is a pre-auth remote code execution vulnerability rooted in the Apache Santuario (XML Security for Java) 1.4.1 library. The XML signature processing in this version can bypass protections, enabling RCE when a SAML SSO flow is engaged by affected ManageEngine...

Exploit for Improper Input Validation in Zohocorp Manageengine_Access_Manager_Plus

CVE-2022-47966 POC for CVE-2022-47966 affecting the following...

SolarWinds Orion Secrets Dump

This module exports and decrypts credentials from SolarWinds Orion Network Performance Monitor NPM to a CSV file; it is intended as a post-exploitation module for Windows hosts with SolarWinds Orion NPM installed. The module supports decryption of AES-256, RSA, and XMLSEC secrets. Separate action...

Vulnerable version of xmlsec used - CVE-2021-40690 in atlassian-authentication-plugin

Recently we have identified that on top of the libraries mentioned in JRASERVER-73580, there was another libraryatlassian-authentication-plugin that has a transitive dependency of xmlsec that could be related to the vulnerability described in...

br.net.woodstock.rockframework:rockframework-core (1.2.4), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=3.0.1) +466 more potentially affected by CVE-2013-2172 via org.apache.santuario:xmlsec (>=1.4.2, <=1.4.6)

org.apache.santuario:xmlsec MAVEN version =1.4.2, =1.2.1, =0.1.14, =12.1.0, =12.1.1, =12.1.2, =12.1.0, =12.1.4, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.0.83-rc1, =1.0.83-rc1, =1.0.112-release - com.ahome-it:ahome-tooling-server-vaadin-core 1.0.112-release and more Source cves: CVE-2013-2172...

br.com.esec.icpm:certillion-client-library (>=1.1.7, <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9, <=1.1.10) +294 more potentially affected by CVE-2013-2172 via org.apache.santuario:xmlsec (>=1.5.1, <=1.5.4)

org.apache.santuario:xmlsec MAVEN version =1.5.1, =1.1.7, =1.1.9, =1.2.5, =ec2-2013-02-01, =1.0 and more Source cves: CVE-2013-2172 Source advisory: GHSA-R237-W2W6-JQ3P...

com.cybersource:cybersource-sdk-java (>=6.0.1, <=6.1.0), com.googlecode.xades4j:xades4j (1.3.2) +62 more potentially affected by CVE-2014-8152 via org.apache.santuario:xmlsec (>=2.0.0, <=2.0.2)

org.apache.santuario:xmlsec MAVEN version =2.0.0, =6.0.1, =2.0.5, =1.0.4, =1.0, =0.9, =0.9, =2.14.0, =3.0.0, =3.0.0, =3.0.0, =3.0.3 and more Source cves: CVE-2014-8152 Source advisory: OSV:GHSA-W7CQ-J9P9-HM3M...

br.com.esec.icpm:certillion-client-library (>=1.1.7, <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9, <=1.1.10) +705 more potentially affected by CVE-2013-4517 via org.apache.santuario:xmlsec (>=1.4.2, <=1.5.5)

org.apache.santuario:xmlsec MAVEN version =1.4.2, =1.1.7, =1.1.9, =1.2.5, =1.2.1, =0.1.14, =12.1.0, =12.1.1, =12.1.2, =12.1.0, =12.1.4, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.0.112-release and more Source cves: CVE-2013-4517 Source advisory: OSV:GHSA-4P4W-6H54-G885...

org.apache.camel:camel-xmlsecurity (>=2.0-m1, <=2.5.0), org.apache.cxf.dosgi.samples:cxf-dosgi-ri-samples-greeter-client (1.0) +71 more potentially affected by CVE-2009-0217 via org.apache.santuario:xmlsec (1.4.2)

org.apache.santuario:xmlsec MAVEN version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.santuario:xmlsec and may be impacted: - org.apache.camel:camel-xmlsecurity =2.0-m1, =2.0.10, =2.0.10, =2.0.10, =2.0.10, =2.0.10, =2.0.10, =2.2.2 ...

org.apache.camel:camel-xmlsecurity (>=2.0-m1, <=2.5.0), org.apache.cxf.dosgi.samples:cxf-dosgi-ri-samples-greeter-client (1.0) +71 more potentially affected by CVE-2009-0217 via org.apache.santuario:xmlsec (1.4.2)

org.apache.santuario:xmlsec MAVEN version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.santuario:xmlsec and may be impacted: - org.apache.camel:camel-xmlsecurity =2.0-m1, =2.0.10, =2.0.10, =2.0.10, =2.0.10, =2.0.10, =2.0.10, =2.2.2 ...

Vulnerable version of xmlsec used - CVE-2021-40690

Affected versions of Atlassian Jira Server and Data Center used versions of xmlsec that were vulnerable to CVE-2021-40690. Affected versions: version 8.22.2 Workaround: version 8.22.2 LTS versions 8.13 and versions up to 8.20.14 should also apply this workaround. This is permanently fixed in...

Moderate: Red Hat Security Advisory: Red Hat Integration - Service Registry release and security update [2.0.3.GA]

An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact o...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 for OpenShift image security and enhancement update

A new image is available for Red Hat Single Sign-On 7.5.1, running on OpenShift Container Platform 3.10 and 3.11, and 4.9. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

cloud.genesys:web-messaging-sdk (>=3.0.0, <=5.0.0), com.chutneytesting:chutney-junit-engine (>=1.3.1, <=1.4.0) +174 more potentially affected by CVE-2021-40690 via org.apache.santuario:xmlsec (1.5.7)

org.apache.santuario:xmlsec MAVEN version 1.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.santuario:xmlsec and may be impacted: - cloud.genesys:web-messaging-sdk =3.0.0, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.0.0, =0.1.0, =127.0.0,...

com.cybersource:cybersource-sdk-java (>=6.2.7, <=6.2.11), com.github.ulisesbocchio:spring-boot-security-saml (>=1.0, <=1.13) +122 more potentially affected by CVE-2021-40690 via org.apache.santuario:xmlsec (1.5.6)

org.apache.santuario:xmlsec MAVEN version 1.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.santuario:xmlsec and may be impacted: - com.cybersource:cybersource-sdk-java =6.2.7, =1.0, =1.0, =1.0, =1.0, =3.0.0-rc.1, =3.0.0-rc.1, =1.0.2,...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=12.1.0), br.com.esec.icpm:certillion-client-library (>=1.1.7, <=1.2.0) +1749 more potentially affected by CVE-2021-40690 via org.apache.santuario:xmlsec (>=1.4.2, <=2.1.6)

org.apache.santuario:xmlsec MAVEN version =1.4.2, =1.0.0.ee-20260424025040, =1.1.7, =1.1.9, =1.2.5, =1.2.1, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0, =0.1.14, =12.1.0, =16.0.4 and more Source cves: CVE-2021-40690 Source advisory:...