553 matches found
CVE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8
Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...
CVE-2021-28973
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks...
Security Bulletin: Rational Asset Analyzer is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2020-4643)
Summary Rational Asset Analyzer team has addressed the following vulnerability: CVE-2020-10693. Vulnerability Details CVEID: CVE-2020-4643 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A...
Fedora 32 : jackson-databind (2021-1d8254899c)
The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-1d8254899c advisory. - A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external...
jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks
A flaw was found in the mercurial plugin in Jenkins. The XML changelog parser is not configured to prevent an XML external entity XXE attack allowing an attacker the ability to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of...
CVE-2021-21266
openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity XXE attack allows attackers in the same network as the openHAB instance to retrieve internal information like the content of files from th...
Xxe
openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity XXE attack allows attackers in the same network as the openHAB instance to retrieve internal information like the content of files from th...
CVE-2021-21266
openHAB versions prior to 2.5.12 and 3.0.1 are affected by an XML external entity (XXE) vulnerability that allows network-local attackers to read files from the file system via XML parsing, with potentially malicious responses to SSDP requests. The issue arises in SAX/JAXB-based XML processing ac...
Security Bulletin: ViewONE is vulnerable to XXE attack when opening PDF documents
Summary ViewONE is vulnerable to XXE attack when opening PDF documents. Vulnerability Details CVEID: CVE-2018-1835 DESCRIPTION: IBM Daeja Virtual is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose...
Security Bulletin: ViewONE is vulnerable to XXE attack via HTTP payload (CVE-2019-4456)
Summary A specially crafted XML payload to the ViewONE service can result in a denial of service attack. Vulnerability Details CVEID: CVE-2019-4456 DESCRIPTION: IBM Daeja ViewONE Professional, Standard & Virtual is vulnerable to an XML External Entity Injection XXE attack when processing XML data...
jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks
A flaw was found in the mercurial plugin in Jenkins. The XML changelog parser is not configured to prevent an XML external entity XXE attack allowing an attacker the ability to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of...
CVE-2020-27148
The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity XXE...
Xxe
The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity XXE...
TIBCO Security Advisory: January 12, 2021 - TIBCO EBXAdd-ons
TIBCO EBX EXML External Entity Original release date: January 12, 2021 Last revised: CVE-2020-27148 Source: TIBCO SoftwareInc. TIBCO EBX EXML External Entity Original release date: January 12, 2021 Last revised: --- Source: TIBCO Software Inc. Systems Affected TIBCO EBX Add-ons versions 4.4.2 and...
TIBCO Security Advisory: January 12, 2021 - TIBCO EBXAdd-ons
TIBCO EBX EXML External Entity Original release date: January 12, 2021 Last revised: CVE-2020-27148 Source: TIBCO SoftwareInc. TIBCO EBX EXML External Entity Original release date: January 12, 2021 Last revised: --- Source: TIBCO Software Inc. Systems Affected TIBCO EBX Add-ons versions 4.4.2 and...
CVE-2020-4606
IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A local attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 184883...
CVE-2020-4606
IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A local attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 184883...
XML External Entity (XXE)
Nokogiri is vulnerable to XML external entity XXE attack. The vulnerability exist as the external DTDs are enabled by default in the XML parser, which would allow an attacker to submit requests on behalf of the server and gain access to internal and local resources...