563 matches found
Xxe
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150905...
Security Bulletin: IBM TRIRIGA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data (CVE-2019-4208)
Summary IBM TRIRIGA is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2019-4208 DESCRIPTION: IBM TRIRIGA is...
Information Disclosure
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the Libraries, 2D, and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain...
Improper Access Control
Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity XXE attacks. A remote...
Xxe
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted XFDF...
CVE-2019-0228
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted XFDF...
CVE-2019-0284
SLD Registration in SAP HANA fixed in versions 1.0, 2.0 does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity XXE. This can cause SLDREG to, for example, continuously loop,...
CVE-2019-10244
In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...
CVE-2019-10244
In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...
Design/Logic Flaw
In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...
CVE-2019-10244
CVE-2019-10244 affects Eclipse Kura up to version 4.0.0. The vulnerability points to XXE attacks via the Web UI package and component services, the Artemis simple MQTT component, and the emulator position service (not part of the device distribution) caused by improper factory and parser initiali...
CVE-2019-10244
In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...
JVN#56542712: Multiple vulnerabilities in Nablarch
Nablarch provided by TIS Inc. contains multiple vulnerabilities listed below. The vulnerability in the function of generic formatter by XXE attacks CWE-611 - CVE-2019-5918 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H| Base Score: 8.2 CVSS v2|...
PT-2019-3872
Name of the Vulnerable Software and Affected Versions libxslt versions 1.1.33 and earlier Description The issue is related to a protection mechanism bypass in libxslt. It allows a remote attacker to bypass security mechanisms and potentially conduct an XXE attack. The problem arises because the...
Security Bulletin: IBM i2 Analyst's Notebook XML Entity Injection Vulnerability
Summary IBM i2 Analyst's Notebook Premium version 9.0.8 has addresses the XML Entity Injection vulnerability detailed in CVE-2018-1527. When using any of the import features on IBM i2 Analyst's Notebook Premium, Cellebrite, XRY, and Notebook Exchange from the Import menu, it is possible to import...
Security Bulletin: Vulnerability in libxml2 affects IBM Chassis Management Module (CVE-2016-9318)
Summary IBM Chassis Management Module has addressed the following vulnerability in libxml2. Vulnerability Details Summary IBM Chassis Management Module has addressed the following vulnerability in libxml2. Vulnerability Details: CVEID: CVE-2016-9318 Description: Libxml2 could allow a remote...
XML External Entity (XXE) Through An XSLT Extension
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity XXE attacks via a crafted XSLT extension in a 1 or 2 JSTL XML tag...
CVE-2018-16166
LogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity XXE attacks via unspecified vectors...
CVE-2018-14720
CVE-2018-14720 affects jackson-databind 2.x prior to 2.9.7, via unsafe polymorphic deserialization that could enable external XML entity (XXE) attacks when failure to block unspecified JDK classes occurs. The connected documents corroborate a fix in 2.9.7 (and related update notes), with multiple...