CVSS: 7.5EPSS: 35%CPEs: 31EXPL: 1CVE-2014-0002 – Camel: XML eXternal Entity (XXE) flaw in XSLT component
https://notcve.org/view.php?id=CVE-2014-0002
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. El componente XSLT en Apache Camel anterior a 2.11.4 y 2.12.x anterior a 2.12.3 permite a atacantes remotos leer archivos arbitrarios y posiblemente tener otro impacto no especificado a través de un documento XML que contiene una declaración de entidad externa en conjunción con una referencia de entidad, relacionado con un problema de XML External Entity (XXE). • http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc http://rhn.redhat.com/errata/RHSA-2014-0371.html http://rhn.redhat.com/errata/RHSA-2014-0372.html http://secunia.com/advisories/57125 http://secunia.com/advisories/57716 http://secunia.com/advisories/57719 http://www.securityfocus.com/bid/65901 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe9 • CWE-264: Permissions, Privileges, and Access Controls CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.8EPSS: 1%CPEs: 51EXPL: 0CVE-2013-4330 – Camel: remote code execution via header field manipulation
https://notcve.org/view.php?id=CVE-2013-4330
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer. Apache Camel anterior a la versión 2.9.7, 2.10.0 anterior a 2.10.7, 2.11.0 anterior a la versión 2.11.2, y 2.12.0 permite a atacantes remotos ejecutar expresiones de lenguaje arbitrarias incluyendo "$simple{}" en una cabecera del mensaje CamelFileName a un productor (1) FILE o (2) FTP. • http://camel.apache.org/security-advisories.data/CVE-2013-4330.txt.asc?version=1&modificationDate=1380535446943 http://osvdb.org/97941 http://packetstormsecurity.com/files/123454 http://rhn.redhat.com/errata/RHSA-2013-1862.html http://rhn.redhat.com/errata/RHSA-2014-0124.html http://rhn.redhat.com/errata/RHSA-2014-0140.html http://rhn.redhat.com/errata/RHSA-2014-0245.html http://rhn.redhat.com/errata/RHSA-2014-0254.html http://seclists.org/fulldisclosure/2013/Sep/178 http:&# • CWE-94: Improper Control of Generation of Code ('Code Injection') •