CVE-2016-6798

In Apache Sling, the XSS Protection API module is affected: versions before 1.0.12 use an insecure SAX parser in XSS.getValidXML(), enabling XML External Entity (XXE) attacks. This can allow attackers to read filesystem data, enable SSRF, perform port scanning behind a firewall, or cause DoS. Pub...

External XML Entity (XXE) Attacks

python3-saml is vulnerable to external XML entity XXE attacks. These attacks are possible through the abuse of XML...

CVE-2017-8913

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

Xxe

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

CVE-2017-5662

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a ful...

XML External Entity (XXE)

Glassfish web-core is vulnerable to XML External Entity XXE attacks. These allow remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference. This is relate...

Xxe

Zimbra Collaboration Suite ZCS before 8.7.4 allows remote attackers to conduct XML External Entity XXE attacks...

CVE-2016-9924

The CVE-2016-9924 issue affects Zimbra Collaboration Suite (ZCS) prior to 8.7.4, where XML External Entity (XXE) processing could be abused by remote attackers. The root cause is insecure XXE handling within ZCS’s XML processing, enabling an attacker to exploit XXE to disclose sensitive informati...

CVE-2017-6895

CVE-2017-6895 concerns the USB Pratirodh tool, which is prone to an XML External Entity (XXE) injection via the usb.xml input. The underlying cause is the XML parser handling untrusted XML data in usb.xml insecurely, enabling XXE. Documented impacts include potential information disclosure and de...

CVE-2017-6895

USB Pratirodh allows remote attackers to conduct XML External Entity XXE attacks via XML data in usb.xml...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

CVE-2016-10127 affects PySAML2 and is an XML External Entity (XXE) vulnerability in SAML XML processing. The issue arises from how the library parses crafted SAML requests/responses, enabling potential data disclosure or other XXE consequences as described in connected sources. The CVE entry also...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

Xxe

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

UBUNTU-CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

CVE-2017-5992

Openpyxl version 2.4.1 is affected by CVE-2017-5992 due to default handling of external entities, enabling XXE via a crafted .xlsx file. Multiple feeds (GHSA, USN, OSV, OpenVAS) corroborate the issue and reference fixed package updates: python36-openpyxl-3.0.7-1.2 and python310-openpyxl-3.1.3-1.1...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...