CVE-2014-5326

CVE-2014-5326 : Direct Web Remoting (DWR) has a cross-site scripting (XSS) vulnerability in versions up to 2.0.10 and 3.x up to 3.0.RC2. A remote attacker could inject arbitrary script/HTML via unspecified vectors in pages using DWR. Public details are consistent across IBM and SUSE advisories co...

CVE-2014-5325

CVE-2014-5325 affects Direct Web Remoting (DWR) prior to fixed versions. The vulnerability stems from XML External Entity (XXE) handling in DWR’s DOMConverter, JDOMConverter, DOM4JConverter, and XOMConverter, allowing remote attackers to read arbitrary files via XML data that contains an external...