xml external entity vulnerabilities and exploits

(subscribe to this query)

4.9

CVSSv3

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote malicious user to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an affected device. To exploit these v...

Cisco Identity Services Engine Cisco Identity Services Engine 3.0.0 Cisco Identity Services Engine 3.1 Cisco Identity Services Engine 3.2

4.9

CVSSv3

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote malicious user to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an affected device. To exploit these v...

Cisco Identity Services Engine Cisco Identity Services Engine 3.0.0 Cisco Identity Services Engine 3.1 Cisco Identity Services Engine 3.2

6.5

CVSSv3

Jenkins pom2config Plugin 1.2 and previous versions does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction o...

Jenkins Pom2config

NA

IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity re...

Ibm Cognos Business Intelligence 10.2 Ibm Cognos Business Intelligence 10.2.1 Ibm Cognos Business Intelligence 10.2.1.1 Ibm Cognos Business Intelligence 8.4.1 Ibm Cognos Business Intelligence 10.1 Ibm Cognos Business Intelligence 10.1.1

1 EDB exploit

7.3

CVSSv3

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote malicious user to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries...

Cisco Sd-wan Firmware

NA

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6032. Reason: This candidate is a duplicate of CVE-2014-6032. Notes: All CVE users should reference CVE-2014-6032 instead of this candidate. All references and descriptions in this candidate have been removed...

7.8

CVSSv3

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary reque...

W3 Epubcheck 4.0.1

NA

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when ...

4.4

CVSSv3

A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local malicious user to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External ...

Cisco Anyconnect Secure Mobility Client

5.5

CVSSv3

XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows malicious users to remotely view local files via a crafted template.xml file.

Blackwave Dive Assistant 8.0

1 EDB exploit

Get Started

« PREV 1 2 3 4 5 6 7 8 9 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook