XXE attack in Mapfish Print

Impact A user can do to an XML External Entity XXE attack with the provided SDL style. Patches Use version = 3.24 Workarounds No References https://cwe.mitre.org/data/definitions/611.html https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e For more...

XML External Entity (XXE)

PostgreSQL JDBC Driver is vulnerable to XML external entity attacks. External DTDs are not disabled by default, allowing an attacker to perform XXE attacks and perform request on behalf of the server or retrieve system files via a malicious XML document...

PT-2020-6672 · Postgresql +9 · Postgresql Jdbc Driver +9

Name of the Vulnerable Software and Affected Versions: PostgreSQL JDBC Driver aka PgJDBC versions prior to 42.2.13 Description: The issue is related to the incorrect restriction of XML external entities, which can lead to XXE attacks. A remote attacker can exploit this to conduct XXE attacks...

CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files...

CVE-2020-2178

Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

PT-2020-15391 · Jenkins · Jenkins Parasoft Findings Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Parasoft Findings Plugin versions 10.4.3 and earlier Description: The issue allows a user who can control the input files for the Parasoft Findings parser to have Jenkins parse a crafted file that uses external entities for extraction...

Topcoder: SVG file upload leads to XML injection

Summary: Upload Avatar option allows the user to upload image/ . Thus enabling the upload of many file formats including SVG files MIME type: image/svg+xml SVG files are XML based graphics files in 2D images. Thus, this opens up an attack vector to upload specially crafted malicious SVG files. Th...

CVE-2019-4391

HCL AppScan Standard is vulnerable to XML External Entity Injection XXE attack when processing XML data...

Informatica: XXE through injection of a payload in the XMP metadata of a JPEG file

Users are able to change their avatar picture. The avatar picture upload functionality is prone to a XXE attack when parsing the image file. Specifically, the XXE attack is executed through the injection of a payload in the "XMP metadata" of the uploaded JPEG file. Proof of concept note the "Burp...

CVE-2015-7968

nwbcext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbcext2int/ URI...

PT-2020-15349 · Jenkins · Jenkins Cobertura Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cobertura Plugin versions 1.15 and earlier Description: The issue allows a user who can control the input files for the 'Publish Cobertura Coverage Report' post-build step to have Jenkins parse a crafted file that uses external...

CVE-2012-6685

Nokogiri before 1.5.4 is vulnerable to XXE attacks...

CVE-2019-12415

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing. Mitigation The...

CVE-2014-2052

CVE-2014-2052 affects Zend Framework used by ownCloud Server. The vulnerability is triggered by an XML External Entity (XXE) attack in Zend Framework that can allow a remote attacker to read arbitrary files, cause a denial of service, and potentially other impacts. Affected products/versions are ...

CVE-2014-2052

Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

Ubuntu 16.04 LTS : Apache Solr vulnerability (USN-4259-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4259-1 advisory. Michael Stepankin and Olga Barinova discovered that Apache Solr was vulnerable to an XXE attack. An attacker could use this vulnerability to remotely execute code...

Ubuntu: Security Advisory (USN-4259-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4259-1: Apache Solr vulnerability

Michael Stepankin and Olga Barinova discovered that Apache Solr was vulnerable to an XXE attack. An attacker could use this vulnerability to remotely execute code...

CVE-2020-2108

Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions...

CVE-2019-4707

IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172018...