CVE-2014-0054

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML Extern...

Moderate: Red Hat Security Advisory: Red Hat JBoss Fuse 6.1.0 update

Red Hat JBoss Fuse 6.1.0, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS bas...

Moderate: Red Hat Security Advisory: Red Hat JBoss A-MQ 6.1.0 update

Red Hat JBoss A-MQ 6.1.0, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS bas...

Apache Camel XSLT XML外部实体漏洞(CVE-2014-0002)

CVECAN ID: CVE-2014-0002 Apache Camel是基于已知的企业级集成模式上的开源集成框架。 Apache Camel 2.11.0-2.11.3、Apache Camel 2.12.0-2.12.2版本的XSLT组件用xslt例程转换XML消息时会解析消息内的实体，可以提交消息到xslt例程的远程攻击者可利用此漏洞，读取可访问的运行中应用服务器上的文件，也可能执行其他更高级的XXE攻击。 0 Apache Group Camel 2.12.3 Apache Group Camel 2.11.4 厂商补丁： Apache Group ------------...

Important: Red Hat Security Advisory: activemq security update

An updated activemq package that fixes multiple security issues is now available for Red Hat OpenShift Enterprise 2.0. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse

More info at https://framework.zend.com/security/advisory/ZF2014-01...

Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse

More info at https://framework.zend.com/security/advisory/ZF2014-01...

Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse

More info at https://framework.zend.com/security/advisory/ZF2014-01...

Moderate: Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 update

Red Hat JBoss SOA Platform 5.3.1 roll up patch 4, which fixes two security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Xxe

The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...

CVE-2013-6440

The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...

CVE-2013-6440

Removed by vendor...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update

An update for Red Hat JBoss Enterprise Application Platform 6.2.0, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common...

CVE-2014-1439

The libxmldisableentityloader function in runtime/ext/extsimplexml.cpp in HipHop Virtual Machine for PHP HHVM before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity XXE attacks...

CVE-2014-1439

The libxmldisableentityloader function in runtime/ext/extsimplexml.cpp in HipHop Virtual Machine for PHP HHVM before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity XXE attacks...

CVE-2014-1439

The CVE-2014-1439 entry concerns HHVM (HipHop Virtual Machine for PHP). The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp does not properly disable a certain libxml handler, enabling XML External Entity (XXE) attacks. Affected versions are HHVM before 2.4.0 and 2.3.x befo...

CVE-2013-7315

CVE-2013-7315 affects Spring Framework’s Spring MVC: the SourceHttpMessageConverter (and related XML processing) fails to disable external entity resolution in the StAX XMLInputFactory for certain versions (Spring Framework before 3.2.4 and 4.0.0.M1–4.0.0.M2). This XXE condition allows context-de...

CVE-2013-4152

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...

Moderate: Red Hat Security Advisory: resteasy security update

Updated resteasy packages that fix one security issue are now available for JBoss Enterprise Application Platform 5.1.2 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS...

Moderate: Red Hat Security Advisory: resteasy security update

Updated resteasy packages that fix one security issue are now available for JBoss Enterprise Web Platform 5.1.2 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base...