709 matches found
GHSA-VC3X-72Q4-G3P5 XML External Entity Reference in jbpmmigration
It was discovered that the XmlUtils class in jbpmmigration performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXtern...
Improper Restriction of XML External Entity Reference in Castor
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted XML document...
GHSA-JWWR-FJGH-CV2X Improper Restriction of XML External Entity Reference in Castor
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted XML document...
Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML
The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...
Security Bulletin: IBM Engineering Requirements Management DOORS Next is vulnerable to XML external entity (XXE) attacks due to FasterXML Jackson Databind (CVE-2020-25649)
Summary IBM Engineering Requirements Management DOORS Next is vulnerable to CVE-2020-25649 due to FasterXML Jackson Databind. FasterXML Jackson Databind is used by IBM Engineering Requirements Management DOORS Next for data mapping between JSON and Java objects. The fix includes FasterXML Jackson...
Server side request forgery (ssrf)
Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document...
CVE-2021-33208
The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file...
CVE-2021-33208
The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file...
CVE-2021-33208
CVE-2021-33208 – MashZone NextGen : Affected product is MashZone NextGen (through 10.7 GA; earlier versions implied by “through 10.7 GA”). The vulnerability is in the admin feature Register an Ehcache Configuration File , caused by an XML external entity (XXE) flaw in processing a malicious XML c...
GHSA-RWG2-W82X-V57J XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the input files for the readXml or writeXml build step to have Jenkins parse a crafted file that uses external entities for...
GHSA-V4RR-65X6-G69F XXE vulnerability in Jenkins Flaky Test Handler Plugin
Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
Xxe
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
CVE-2022-28140
CVE-2022-28140 affects Jenkins Flaky Test Handler Plugin, version 1.2.1 and earlier. The root cause is that the plugin’s XML parser is not configured to prevent XML external entity (XXE) attacks. Per CNVD/GHSA, this XXE issue can enable an attacker to extract secrets from the Jenkins controller (...
XML External Entities (XXE)
cvrf2csaf is vulnerable to XML External Entity XXE attacks. The vulnerability exists due to improper input validation in the validateinputagainstschema function in the validateinputagainstschema file This allows to view arbitrary file content...
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
Jenkins Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and returns version information. The XML parser is not configured to prevent XML external entity XXE attacks, which is only a problem if XML documents are parsed on the Jenkins controller...
XML External Entity Reference in Hazelcast
The AbstractXmlConfigRootTagRecognizer function makes use of SAXParser generated from a SAXParserFactory with no FEATURESECUREPROCESSING set, allowing for XXE attacks...
Hazelcast code issue vulnerability
Hazelcast Hazelcast IMDG is a scalable open-source data distribution platform from Hazelcast, Inc. The platform supports a variety of distributed data structures, distributed caching and other features. Hazelcast versions prior to 5.1 of XML has a code problem vulnerability, which stems from not...
Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. As the plugin does not configure its XML parser to prevent XML external entity XXE attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for...
GHSA-38W8-H222-WRPP Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. As the plugin does not configure its XML parser to prevent XML external entity XXE attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for...