#TECHSMITH SNAGIT 10.0.2 DOWNLOAD#

One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.Ī vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions Languages -> Edit Language -> Import Resources -> Upload XML file' screen.īlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.īMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue.ĭigiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. Setting the configuration option ' = true' may mitigate these issues. ** UNSUPPORTED WHEN ASSIGNED ** Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF.

Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously. Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. The SAML 2.0 messages constructed during the authentication flow in Apache CloudStack are XML-based and the XML data is parsed by various standard libraries that are now understood to be vulnerable to XXE injection attacks such as arbitrary file reading, possible denial of service, server-side request forgery (SSRF) on the CloudStack management server. When the SAML 2.0 plugin is enabled in affected versions of Apache CloudStack could potentially allow the exploitation of XXE vulnerabilities. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection.

Techsmith snagit 10.0.2