JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2018-15531 · ADVISORY
• javamelody/javamelody commit ef11182 · WEB
• GitHub Advisory GHSA-6fvx-r7hx-3vh6 · ADVISORY
• javamelody/javamelody · PACKAGE
• javamelody/javamelody · WEB
• jenkins.io/security/advisory/2018-09-25 · WEB
• openwall.com/lists/oss-security/2018/09/25/3 · WEB
• jenkins.io/security/advisory/2018-09-25 · Third Party Advisory

Lỗ hổng khác của net.bull.javamelody:javamelody-core

• CVE-2016-1000273NGHIÊM TRỌNG 10.0Java Melody vulnerable to cross-site scripting
• CVE-2018-12432TRUNG BÌNH 6.1JavaMelody through 1.60.0 has XSS via the counter parameter in a clear_counter action to the /monitoring URI.
• CVE-2013-4378TRUNG BÌNH 4.3Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inj…