CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2015-0263 – Camel: XXE in via SAXSource expansion
https://notcve.org/view.php?id=CVE-2015-0263
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource. Vulnerabilidad de entidad externa XML (XXE) en el montaje del convertidor XML en converter/jaxp/XmlConverter.java en Apache Camel anterior a 2.13.4 y 2.14.x anterior a 2.14.2 p3ermite a atacantes remotos leer ficheros arbitrarios a través de una entidad externa en una SAXSource. It was found that Apache Camel's XML converter performed XML External Entity (XXE) expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. • http://rhn.redhat.com/errata/RHSA-2015-1041.html http://rhn.redhat.com/errata/RHSA-2015-1538.html http://rhn.redhat.com/errata/RHSA-2015-1539.html http://www.securitytracker.com/id/1032442 https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc https://git-wip-us.apache.org/repos/asf?p=camel.git%3Ba=commitdiff%3Bh=7d19340bcdb42f7aae584d9c5003ac4f7ddaee36 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://li • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2015-0264 – Camel: XXE via XPath expression evaluation
https://notcve.org/view.php?id=CVE-2015-0264
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query. Múltiples vulnerabilidades de entidad externa XML (XXE) en builder/xml/XPathBuilder.java en Apache Camel anterior a 2.13.4 y 2.14.x anterior a 2.14.2 permiten a atacantes remotos leer ficheros arbitrarios a través de una entidad externa en un objeto XML (1) String o (2) GenericFile inválido en una consulta XPath. It was found that Apache Camel performed XML External Entity (XXE) expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. • http://rhn.redhat.com/errata/RHSA-2015-1041.html http://rhn.redhat.com/errata/RHSA-2015-1538.html http://rhn.redhat.com/errata/RHSA-2015-1539.html http://securitytracker.com/id/1032442 https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc https://git-wip-us.apache.org/repos/asf?p=camel.git%3Ba=commitdiff%3Bh=1df559649a96a1ca0368373387e542f46e4820da https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists. • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 47%CPEs: 31EXPL: 1CVE-2014-0003 – Camel: remote code execution via XSL
https://notcve.org/view.php?id=CVE-2014-0003
The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message. El componente XSLT en Apache Camel 2.11.x anterior a 2.11.4, 2.12.x anterior a 2.12.3 y posiblemente versiones anteriores permite a atacantes remotos ejecutar métodos Java arbitrarios a través de un mensaje manipulado. • http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc http://rhn.redhat.com/errata/RHSA-2014-0245.html http://rhn.redhat.com/errata/RHSA-2014-0254.html http://rhn.redhat.com/errata/RHSA-2014-0371.html http://rhn.redhat.com/errata/RHSA-2014-0372.html http://secunia.com/advisories/57125 http://secunia.com/advisories/57716 http://secunia.com/advisories/57719 http://www.securityfocus.com/bid/65902 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b3 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 35%CPEs: 31EXPL: 1CVE-2014-0002 – Camel: XML eXternal Entity (XXE) flaw in XSLT component
https://notcve.org/view.php?id=CVE-2014-0002
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. El componente XSLT en Apache Camel anterior a 2.11.4 y 2.12.x anterior a 2.12.3 permite a atacantes remotos leer archivos arbitrarios y posiblemente tener otro impacto no especificado a través de un documento XML que contiene una declaración de entidad externa en conjunción con una referencia de entidad, relacionado con un problema de XML External Entity (XXE). • http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc http://rhn.redhat.com/errata/RHSA-2014-0371.html http://rhn.redhat.com/errata/RHSA-2014-0372.html http://secunia.com/advisories/57125 http://secunia.com/advisories/57716 http://secunia.com/advisories/57719 http://www.securityfocus.com/bid/65901 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe9 • CWE-264: Permissions, Privileges, and Access Controls CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.8EPSS: 1%CPEs: 51EXPL: 0CVE-2013-4330 – Camel: remote code execution via header field manipulation
https://notcve.org/view.php?id=CVE-2013-4330
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer. Apache Camel anterior a la versión 2.9.7, 2.10.0 anterior a 2.10.7, 2.11.0 anterior a la versión 2.11.2, y 2.12.0 permite a atacantes remotos ejecutar expresiones de lenguaje arbitrarias incluyendo "$simple{}" en una cabecera del mensaje CamelFileName a un productor (1) FILE o (2) FTP. • http://camel.apache.org/security-advisories.data/CVE-2013-4330.txt.asc?version=1&modificationDate=1380535446943 http://osvdb.org/97941 http://packetstormsecurity.com/files/123454 http://rhn.redhat.com/errata/RHSA-2013-1862.html http://rhn.redhat.com/errata/RHSA-2014-0124.html http://rhn.redhat.com/errata/RHSA-2014-0140.html http://rhn.redhat.com/errata/RHSA-2014-0245.html http://rhn.redhat.com/errata/RHSA-2014-0254.html http://seclists.org/fulldisclosure/2013/Sep/178 http:&# • CWE-94: Improper Control of Generation of Code ('Code Injection') •