CVE-2014-5325

dwr: XML external entity injection (JVN#91502163)

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed

Vendors

Directwebremoting

Products

Direct Web Remoting

CVE-2015-1832

Derby: XXE attack possible by using XmlVTI and the XML datatype

XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.

CVSS 3.0 · 9.1 Critical EPSS 12.2% KEV · Not listed

Vendors

Apache

Products

Derby

CVE-2015-1818

dashbuilder: XXE/SSRF vulnerability

XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.

CVSS 2.0 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Redhat

Products

Jboss Bpm Suite Jboss Bpms Jboss Data Virtualization

CVE-2014-8680

bind: flaws in GeoIP leading to a denial of service

The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named exit) via vectors related to (1) the lack of GeoIP databases for both IPv4 and IPv6, or (2) IPv6 support with certain options.

CVSS 2.0 · 5.4 Medium EPSS 9.0% KEV · Not listed

Vendors

Isc

Products

Bind

CVE-2016-3720

jackson-dataformat-xml: XmlMapper is vulnerable to XXE attack

XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Fasterxml Fedoraproject

Products

Jackson-dataformat-xml Fedora

CVE-2014-0002

Camel: XML eXternal Entity (XXE) flaw in XSLT component

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 7.5 High EPSS 27.4% KEV · Not listed

Vendors

Apache Redhat

Products

Camel Fuse Esb Enterprise Fuse Management Console and 6 more

CVE-2014-2062

jenkins: user tokens not invalidated correctly (SECURITY-89)

Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.

CVSS 2.0 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3481

JAX-RS: Information disclosure via XML eXternal Entity (XXE)

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Redhat

Products

Jboss Data Grid Jboss Data Virtualization Jboss Enterprise Application Platform and 3 more

CVE-2014-3485

ovirt-engine-api: XML eXternal Entity (XXE) flaw

The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 4.0 Medium EPSS 1.5% KEV · Not listed

Vendors

Redhat

Products

Enterprise Virtualization Rhev Manager

CVE-2014-3490

RESTEasy: XXE via parameter entities

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

CVSS 2.0 · 7.5 High EPSS 4.6% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Bpms Jboss Brms and 8 more

CVE-2014-3530

PicketLink: XXE via insecure DocumentBuilderFactory usage

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Redhat

Products

Jboss Bpms Jboss Brms Jboss Data Grid and 7 more

CVE-2014-3573

Engine: XML eXternal Entity (XXE) flaw in backend module

The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Redhat

Products

Enterprise Virtualization Manager Rhev Manager

CVE-2014-8125

jBPM: BPMN2 file processing XXE in Process Execution

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

CVSS 2.0 · 7.5 High EPSS 2.6% KEV · Not listed

Vendors

Redhat

Products

Drools Jboss Bpms Jboss Brms and 1 more

CVE-2014-8162

Satellite5: RPC API XML External Entities file disclosure

XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Redhat Suse

Products

Network Satellite Manager

CVE-2014-9130

libyaml: assert failure when processing wrapped strings

scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.

CVSS 2.0 · 5.0 Medium EPSS 13.2% KEV · Not listed

Vendors

Pyyaml Redhat

Products

Libyaml Enterprise Linux Openstack and 1 more

CVE-2015-0248

subversion: (mod_dav_svn) remote denial of service with certain requests with dynamically evaluated revision numbers

The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.

CVSS 2.0 · 5.0 Medium EPSS 12.8% KEV · Not listed

Vendors

Apache Apple Opensuse and 2 more

Products

Subversion Xcode Opensuse and 7 more

CVE-2015-0250

batik: XML External Entity (XXE) injection in SVG parsing

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

CVSS 2.0 · 6.4 Medium EPSS 16.6% KEV · Not listed

Vendors

Apache Canonical Redhat

Products

Batik Ubuntu Linux Jboss Bpms and 2 more

CVE-2015-0263

Camel: XXE in via SAXSource expansion

XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.

CVSS 2.0 · 5.0 Medium EPSS 7.5% KEV · Not listed

Vendors

Apache Redhat

Products

Camel Jboss Amq Jboss Bpms and 3 more

CVE-2015-0264

Camel: XXE via XPath expression evaluation

Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.

CVSS 2.0 · 5.0 Medium EPSS 7.1% KEV · Not listed

Vendors

Apache Redhat

Products

Camel Jboss Amq Jboss Bpms and 3 more

CVE-2015-0293

openssl: assertion failure in SSLv2 servers

The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.

CVSS 2.0 · 5.0 Medium EPSS 21.2% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Application Platform and 5 more