PT-2015-4128

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions 7.2.2 before IF15 and 7.5 before IF24 Tivoli Asset Discovery for Distributed versions 7.2.2 before IF15 and 7.5 before IF24 Description The issue allows remote attackers to read arbitrary files or send TCP...

SUSE SLED10 Security Update : inkscape (SUSE-SU-2013:0350-1)

inkscape has been updated to fix a XXE Xml eXternal Entity attack during rasterization of SVG images. CVE-2012-5656, where the rendering of malicious SVG images could have connected from inkscape to internal hosts. Note that Tenable Network Security has extracted the preceding description block...

CVE-2015-2346

XML external entity XXE vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter...

Xxe

XML external entity XXE vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter...

CVE-2015-2346

Vulnerability: CVE-2015-2346 is an XXE flaw in Huawei SEQ Analyst prior to V200R002C03LG0001CP0022. An authenticated remote attacker can read arbitrary files via the req parameter. Affected product: Huawei SEQ Analyst. Root cause: XML External Entity processing. Impact: unauthorized file disclosu...

SEC Consult SA-20150513-0 :: Multiple critical vulnerabilities in WSO2 Identity Server

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20150513-0 ======================================================================= title: Multiple critical vulnerabilities product: WSO2 Identity Server other WSO2 Carbon based products may be affected...

CVE-2015-2346: Undefined Security Weakness

XML external entity XXE vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter...

PT-2015-5723

Name of the Vulnerable Software and Affected Versions Huawei SEQ Analyst versions prior to V200R002C03LG0001CP0022 Description The issue allows remote authenticated users to read arbitrary files. This is achieved via the req parameter, which is vulnerable to XML external entity XXE attacks...

CVE-2014-8162

XML external entity XXE in the RPC interface in Spacewalk and Red Hat Network RHN Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors...

CVE-2014-8162

XML external entity XXE in the RPC interface in Spacewalk and Red Hat Network RHN Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors...

CVE-2014-8162

Summary: CVE-2014-8162 describes an XML External Entity (XXE) vulnerability in the RPC interface of Spacewalk and Red Hat Network (RHN) Satellite, affecting version 5.7 and earlier. The issue allows a remote attacker to read arbitrary files and potentially other unspecified impact via unknown vec...

CVE-2014-8162: Undefined Security Weakness

XML external entity XXE in the RPC interface in Spacewalk and Red Hat Network RHN Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors...

Medium: tomcat7

Issue Overview: It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data,...

Oracle blind injection combined with XXE vulnerability remote data acquisition-vulnerability warning-the black bar safety net

Presumably everyone onSQL injectionhas been familiar for XML entity injection, or XXE, is also. This paper mainly discussed the method in the presence of the ORACLE the blind the case of remote access to the data. In fact, and UTLHTTP Remote Access Method of the same, but the principle is...

WSO2 Identity Server 5.0.0 XSS / CSRF / XXE Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: WSO2 Identity Server other WSO2 Carbon based products may be affected too...

PT-2015-2046

Name of the Vulnerable Software and Affected Versions SAP Afaria affected versions not specified SAP Mobile Platform version 2.3 Description The issue allows a remote attacker to inject arbitrary JavaScript code by sending a specially crafted request to the Xcomms network service. Additionally,...

CVE-2015-3451

The clone function in XML::LibXML before 2.0119 does not properly set the expandentities option, which allows remote attackers to conduct XML external entity XXE attacks via crafted XML data to the 1 new or 2 loadxml function...

CVE-2015-3451

The clone function in XML::LibXML before 2.0119 does not properly set the expandentities option, which allows remote attackers to conduct XML external entity XXE attacks via crafted XML data to the 1 new or 2 loadxml function...

Xxe

The clone function in XML::LibXML before 2.0119 does not properly set the expandentities option, which allows remote attackers to conduct XML external entity XXE attacks via crafted XML data to the 1 new or 2 loadxml function...

CVE-2015-3451

CVE-2015-3451 affects XML::LibXML prior to 2.0119. The _clone function does not properly preserve or set the expand_entities option, enabling XML external entity (XXE) attacks via crafted XML data to the new or load_xml entry points. The connected sources confirm the vulnerable component and the ...