553 matches found
CVE-2024-45048
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been...
CVE-2024-45048
CVE-2024-45048 (PHPSpreadsheet) : A bypass of a filter in affected PHPSpreadsheet versions enables an XXE attack, allowing access to local file contents even when error reporting is muted. The vulnerability is fixed in release 2.2.1; all users should upgrade to that version. Impact is described a...
CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been...
CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been...
Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce
CVE-2024-34102 ★ Thanks to @th3gokul, Sanjaith3hacker, Chocapi...
Security Bulletin: IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack.(CVE-2024-2235)
Summary IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume...
CVE-2021-47621
ClassGraph before 4.8.112 was not resistant to XML eXternal Entity XXE attacks...
Security Bulletin: IBM Financial Transaction Manager is vulnerable to an XML External Entity Injection (XXE) attack
Summary IBM Financial Transaction Manager for ACH and Check Service v3.0.5.4 and v3.0.5.5 has addressed an XML External Entity Injection vulnerability. Vulnerability Details CVEID:CVE-2023-35892 DESCRIPTION: IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML Extern...
CVE-2024-22354 IBM WebSphere Application Server XML external entity injection
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memo...
openSUSE Security Advisory (SUSE-SU-2024:1304-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ROS-20240409-02
Vulnerability of the hmac.comparedigest function of the Lib/hmac.py library of the programming language interpreter Python is related to synchronization errors when using a shared resource "Race Situation". Exploitation of the vulnerability could allow an attacker acting remotely to escalate thei...
Security Bulletin: IBM Maximo Asset Management application may be affected by XML External Entity (XXE) attack (CVE-2024-27266)
Summary IBM Maximo Asset Management application may be affected by XML External Entity XXE attack. Vulnerability Details CVEID:CVE-2024-27266 DESCRIPTION: IBM Maximo Application Suite is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could...
BIT-WORDPRESS-MULTISITE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8
Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...
CVE-2024-25129
The CVE-2024-25129 entry concerns CodeQL CLI prior to version 2.16.3, where an XML External Entity flaw in the CLI’s XML parser can cause the CLI to fetch an HTTP URL containing data read from a local file when processing malicious databases or specially crafted QL sources. Impact described as po...
CVE-2023-32327
IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...
CVE-2023-32327 IBM Security Access Manager Container XML external entity injection
IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...
VulnCheck KEV: CVE-2020-4463
IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484...
Out-of-bounds
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the noxxe option of XML::Twig...
UBUNTU-CVE-2024-23525
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the noxxe option of XML::Twig...
CVE-2024-23525
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the noxxe option of XML::Twig...