CVE-2015-0263

Apache Camel contains an XXE in the XML converter setup (converter/jaxp/XmlConverter.java) affecting versions before 2.13.4 and 2.14.x before 2.14.2, allowing remote attackers to read arbitrary files via an external entity in SAXSource. Remediation: upgrade to Camel 2.13.4+ or 2.14.2+. Exploitati...

CVE-2015-0264

CVE-2015-0264: In Apache Camel, multiple XXE vulnerabilities exist in builder/xml/XPathBuilder.java that allow reading arbitrary files when processing invalid XML strings or GenericFile objects via an XML External Entity (XXE) declaration. Affected versions are Camel before 2.13.4 and 2.14.x befo...