Description

The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

Remediation

References

CVE-2012-2928

Related Vulnerabilities

Jenkins Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2018-1000193)

WordPress Plugin PromoBar by BestWebSoft Cross-Site Scripting (1.1.0)

WordPress Plugin Better Search Replace Cross-Site Request Forgery (1.3.2)

Jenkins 7PK - Security Features Vulnerability (CVE-2014-9635)

WordPress Plugin Age Gate Security Bypass (2.17.0)

Severity

Medium

Classification

CVE-2012-2928 CWE-264

Tags

Missing Update Known Vulnerabilities