CVE-2012-6685

Nokogiri before 1.5.4 is vulnerable to XXE attacks...

Design/Logic Flaw

Nokogiri before 1.5.4 is vulnerable to XXE attacks...

CVE-2012-6685

Nokogiri before 1.5.4 is vulnerable to XXE attacks...

CVE-2020-2120

Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks...

CVE-2020-2115

Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity XXE attacks...

CVE-2020-2120

The CVE-2020-2120 relates to Jenkins FitNesse Plugin (versions 1.30 and earlier) where the XML parser is not configured to disable external entities (XXE). This can allow crafted input files supplied to the plugin’s post-build step to trigger XXE processing, enabling potential extraction of secre...

CVE-2020-2120

Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks...

CVE-2020-2115

CVE-2020-2115 affects Jenkins NUnit Plugin 0.25 and earlier. The root cause is that the XML parser is not configured to prevent XML External Entity (XXE) attacks, allowing an attacker who controls input files for the post-build step to have Jenkins parse crafted XML and potentially leak secrets, ...

GHSA-MGH8-HCWJ-H57V Improper Restriction of XML External Entity Reference in Apache Olingo

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks...

Improper Restriction of XML External Entity Reference in Apache Olingo

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks...

CVE-2020-2108

CVE-2020-2108 affects Jenkins WebSphere Deployer Plugin 1.6.1 and earlier. The root cause is the XML parser not configured to disable XML External Entity (XXE) processing, allowing XXE exploitation. An attacker with Job/Configure permissions can upload a specially crafted WAR containing WEB-INF/i...

Security Bulletin: Vulnerability in Apache PDFBox Affects IBM Control Center (CVE-2019-0228)

Summary Vulnerability in Apache PDFBox Affects IBM Control Center CVE-2019-0228 Vulnerability Details CVEID: CVE-2019-0228 DESCRIPTION: Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity XXE attacks via a craft...

CVE-2019-16549

Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents...

CVE-2019-16549

Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents...

XML External Entity (XXE)

modoboadmarc is vulnerable to XML external entity XXE attacks. During the import of aggregated DMARC report, unsanitized XML data is automatically parsed and fed to the database. This allows an attacker to access and retrieve system files or perform requests on behalf of the server...

Apache Olingo OData 4.0 - XML External Entity Injection

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Apache Olingo OData 4.0 Vendor: Apache Foundation CSNC ID: CSNC-2009-025 CVE ID: CVE-2019-17554 Subject: XML External Entity Resolution XXE Risk: High Effect: Remotely exploitable Author: Archibald Haddock...

XML External Entity (XXE)

odata-server-core is vulnerable to XML external entity XXE attacks. The support for external entities are not disabled and allows remote attackers to inject a malicious XML document to retrieve confidential system files or perform requests on behalf of the server...

Design/Logic Flaw

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed...

CVE-2019-17554

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks...

CVE-2019-17554

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks...