CVE-2022-28219

Summary of CVE-2022-28219 findings (Zoho ManageEngine ADAudit Plus) : ADAudit Plus versions before build 7060 are vulnerable to an unauthenticated XML External Entity (XXE) injection and a path traversal in the /cewolf endpoint, enabling remote code execution. Public advisories (and multiple secu...

CVE-2021-33208

The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file...

PT-2022-18839 · Jenkins · Jenkins Flaky Test Handler Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Flaky Test Handler Plugin versions 1.2.1 and earlier Description: The issue is related to the configuration of the XML parser, which does not prevent XML external entity XXE attacks. This allows for potential exploitation...

CVE-2020-14478

A local, authenticated attacker could use an XML External Entity XXE attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitrarily read any local file via system-lev...

Xxe

A local, authenticated attacker could use an XML External Entity XXE attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitrarily read any local file via system-lev...

CVE-2020-14478

CVE-2020-14478 is an XXE (XML External Entity) vulnerability affecting Rockwell Automation FactoryTalk Services Platform. The root cause is improper restriction of XML external entity references in the platform, allowing a local, authenticated attacker to access local or remote content and potent...

CVE-2021-46660

CVE-2021-46660 affects Signiant Manager+Agents prior to version 15.1 . The issue is an XML External Entity (XXE) vulnerability in XML processing. Per CVSS 3.1/2.0 metrics, the impact is High (confidentiality, integrity, availability) with network vector and no user interaction. Remediation: upgra...

Mageia: Security Advisory (MGASA-2016-0175)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-4875

IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 190838...

in hazelcast/hazelcast

Description The AbstractXmlConfigRootTagRecognizer function makes use of SAXParser generated from a SAXParserFactory with no FEATURESECUREPROCESSING set, allowing for XXE attacks. In...

CVE-2021-43577

Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Security Bulletin: Using components with known vulnerabilities in IBM Security Guardium Key Lifecycle Manager (CVE-2021-20492)

Summary Using components with known vulnerabilities in IBM Security Guardium Key Lifecycle Manager CVE-2021-20492. Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection XXE...

XML External Entity (XXE) Injection

MODX CMS is vulnerable to XML external entity attacks. The vulnerability exists in the 'collectRequestParameters' function in 'modrestservice.class.php' because the user input is directly parsed without proper sanitation resulting an XXE attack which leads to a leakage of sensitive information or...

CVE-2021-20839

Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity XXE attack to cause a denial of service DoS condition to the other servers by processing a specially crafted XML document...

CVE-2021-20838

Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity XXE attack to cause a denial of service DoS condition by processing a specially crafted XML document...

CVE-2021-20839

Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity XXE attack to cause a denial of service DoS condition to the other servers by processing a specially crafted XML document...

CVE-2021-20839

The CVE-2021-20839 entry concerns Antenna House Office Server Document Converter. Affects V7.2MR4 and earlier and V7.1MR7 and earlier. The flaw is an XML External Entity (XXE) vulnerability in processing specially crafted XML documents, enabling a remote unauthenticated attacker to cause a denial...

CVE-2021-20838

Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity XXE attack to cause a denial of service DoS condition by processing a specially crafted XML document...

CVE-2021-20838

CVE-2021-20838 affects Antenna House Office Server Document Converter. Exploitation stems from an XML External Entity (XXE) vulnerability in the PDF/XML processing path, allowing a remote unauthenticated attacker to trigger a DoS by processing a crafted XML document. Affected versions include V7....

CVE-2020-26705

The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity XXE vulnerability which allows for an attacker to expose sensitive data or perform a denial of service DOS via a crafted external entity entered into the XML content as input...