CVE-2018-13416

In Universal Media Server UMS 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary XML Entity Expansion vulnerability CVE-2018-1702 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1702 DESCRIPTION: IBM Spectrum Symphony is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could...

Plex Media Server -- Information Disclosure Vulnerability

Chris reports: The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same LAN can use this vulnerability to: Access arbitrary files from the filesystem with the same permission as the...

Xxe

It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML...

Security Bulletin: FileNet Content Management Interoperability Services (CMIS), which ships with IBM Content navigator, is affected by the ability to parse untrusted XML input containing a reference to an external entity

Summary FileNet Content Management Interoperability Services CMIS, which ships with IBM Content Navigator, is affected by the following vulnerability: Ability to process untrusted XML input containing a reference to an external entity that is parsed by a weekly configured XML parser. Vulnerabilit...

CVE-2018-1542

IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platform Engine ACCE 5.2.1 and 5.5.0 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose...

CVE-2018-1542

IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platform Engine ACCE 5.2.1 and 5.5.0 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose...

XML External Entity (XXE)

Apache Solr is vulnerable to XML External Entity XXE attacks. The library uses an insecure DocumentBuilderFactory class is to parse the currency.xml and enumsConfig.xml files. This can allow a malicious user with access to these files to conduct an XXE attack to reveal sensitive information...

Security Bulletin: A vulnerability in libxml2 affects IBM Flex System Manager (FSM) (CVE-2016-9318)

Summary A vulnerability has been discovered in libxml2 that is embedded in FSM. This bulletin addresses that issue. Vulnerability Details CVEID: CVE-2016-9318 DESCRIPTION: Libxml2 could allow a remote attacker to obtain sensitive information, caused by failure to offer a flag directly indicating...

Security Bulletin: IBM Rational Software Architect Design Manager does not handle incoming requests containing XML in a safe manner (CVE-2018-1456, CVE-2018-1587)

Summary Usage of XML external entities in RSA DM linktype definitions comprises a security risk including disclosure of local files. An error message displayed when parsing incorrect XML can disclose unnecessary technical details that can be potentially used to construct new attacks. Vulnerabilit...

Security Bulletin: Multiple vulnerabilities in XMLsoft Libxml2 affect IBM Streams

Summary There are multiple vulnerabilities in Libxml2 library used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVE-ID: CVE-2016-2073 Description: libxml2 is vulnerable to a heap-based buffer overflow, caused by an out-of-bounds read in the...

Security Bulletin: Vulnerability in dependent component distributed in IBM Development Package for Apache Spark (CVE-2015-1832)

Summary Apache Derby versions up to 10.12.1.1 may be susceptible to an XML external entity XXE attack. Hive's metastore, where created, requires Derby when Apache Hadoop data sources are used with Apache Spark. Apache Derby is therefore included in the IBM Development Package for Apache Spark...

Security Bulletin: IBM Business Process Manager (BPM) document store is susceptible to XXE (XML External Entity) attacks. (CVE-2013-5452)

Summary An XML eXternal Entity XXE vulnerability has been reported for the embedded component used by IBM BPM document store. Vulnerability Details CVEID: CVE-2013-5452 DESCRIPTION: The IBM FileNet Business Process Framework is vulnerable to an XML external entity attack. A remote attacker could...

CVE-2018-5433

The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion XXE attacks to disclose host machine...

CVE-2018-5434

The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion XXE attacks to disclose host machine information. Affected releases are TIBCO Software Inc.'...

CVE-2018-1456

IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 140091...

CVE-2018-10832

ModbusPal 1.6b is vulnerable to an XML External Entity XXE attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will retu...

CVE-2018-10832

ModbusPal 1.6b is vulnerable to an XML External Entity XXE attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will retu...

CVE-2018-1308

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion XXE in the &dataConfig= parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the...

Debian DLA-1299-1 : libjgraphx-java security update

It was discovered that there was a potential XML External Entity XXE attack in libjgraphx-java, a diagramming library for Java applications. For Debian 7 'Wheezy', this issue has been fixed in libjgraphx-java version 1.4.1.0-3+deb7u1. We recommend that you upgrade your libjgraphx-java packages...