709 matches found
Deserialization of untrusted data
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks...
CVE-2019-17554
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks...
CVE-2019-10080
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE and reveal information such as the versions of Java, Jersey, and Apache that the NiFI...
Micro Focus Operations Agent XXE Vulnerability
Micro Focus Operations Agent helps you monitor your system by collecting metrics that indicate the operational status, performance, resource utilization, and availability of essential elements of your system. A XXE vulnerability exists in Micro Focus Operations Agent, which can be exploited by...
GHSA-XWX6-VMJ4-5RV8 Denial of service via deserialization attack in nifi
A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB...
Denial of service via deserialization attack in nifi
A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB...
CVE-2019-14276
WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...
Design/Logic Flaw
WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...
CVE-2019-14276
WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...
CVE-2019-16188
HCL AppScan Source before 9.03.13 is susceptible to XML External Entity XXE attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the conte...
Xxe
HCL AppScan Source before 9.03.13 is susceptible to XML External Entity XXE attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the conte...
CVE-2019-13608
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks...
CVE-2019-13608
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks...
CVE-2019-13608
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
CVE-2019-15641
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...
Default credentials
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...
CVE-2019-15641
CVE-2019-15641 affects Webmin via xmlrpc.cgi, where an authenticated XXE exists in Webmin up to version 1.930 (patch included in later versions). Impact: potential disclosure of sensitive data due to XML external entity processing; access is restricted in affected setups to root/admin/sysadm by d...
CVE-2019-14258
The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988...