Important: expat

Issue Overview: libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate. CVE-2024-28757 Affected Packages: expat Issue Correction: Run dnf update expat --releasever 2023.4.20240401 to update your system...

Oracle Linux 9 : expat (ELSA-2024-1530)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1530 advisory. - CVE-2023-52425: Fix parsing of large tokens - CVE-2024-28757: Reject direct parameter entity recursion Tenable has extracted the preceding descriptio...

Moderate: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 9. 'Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

expat: XML Entity Expansion

An XML Entity Expansion flaw was found in libexpat. This flaw allows an attacker to cause a denial of service when there is an isolated use of external parsers...

LangChain's XMLOutputParser vulnerable to XML Entity Expansion

The XMLOutputParser in LangChain uses the etree module from the XML parser in the standard python library which has some XML vulnerabilities; see: https://docs.python.org/3/library/xml.html This primarily affects users that combine an LLM or agent with the XMLOutputParser and expose the component...

WordPress VK All in One Expansion Unit Plugin <= 9.95.0.1 is vulnerable to Sensitive Data Exposure

Software VK All in One Expansion Unit Type Plugin Vulnerable versions = 9.95.0.1 Fixed in 9.96.0.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2093 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d4653e32a362 Credits Krzyszt...

VK All in One Expansion Unit < 9.97.0.0 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its child page index widget options such as className before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

VK All in One Expansion Unit < 9.96.0.0 - Unauthenticated Password Protected Content Access

Description The plugin is vulnerable to Sensitive Information Exposure via social meta tags, allowing unauthenticated attackers to view limited password protected content...

WordPress VK All in One Expansion Unit Plugin <= 9.96.0.1 is vulnerable to Cross Site Scripting (XSS)

Software VK All in One Expansion Unit Type Plugin Vulnerable versions = 9.96.0.1 Fixed in 9.97.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2170 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 26bb3cd6172a Credits Ngô...

ALSA-2024:1530 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: parsing large tokens can trigger a denial of service CVE-2023-52425 expat: XML Entity Expansion CVE-2024-28757...

Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: parsing large tokens can trigger a denial of service CVE-2023-52425 expat: XML Entity Expansion CVE-2024-28757...

RHEL 9 : expat (RHSA-2024:1530)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1530 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: parsing large tokens can trigger a denial of service CVE-2023-52425...

UBUNTU-CVE-2021-47152

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data stream corruption Maxim reported several issues when forcing a TCP transparent proxy to use the MPTCP protocol for the inbound connections. He also provided a clean reproducer. The problem boils down to...

PT-2024-19018 · WordPress · Vk All In One Expansion Unit

Name of the Vulnerable Software and Affected Versions: VK All in One Expansion Unit plugin for WordPress versions up to, and including, 9.96.0.1 Description: The issue is related to Stored Cross-Site Scripting via the child page index widget due to insufficient input sanitization and output...

The vulnerability of the microprogrammed power switching equipment of Siemens SENTRON 3KC ATC6 Expansion Module Ethernet lies in the presence of undocumented configuration commands, which can be exploited by attackers to cause malfunctions during maintenance.

The vulnerability of the microprogrammed power switching software of Siemens SENTRON 3KC ATC6 Expansion Module Ethernet is related to the presence of undocumented configuration commands. Exploiting this vulnerability can allow a malicious actor to cause malfunctions in the service operation...

Security Bulletin: A security vulnerability has been disclosed in Expat, which is installed as part of IBM Tivoli Network Manager (CVE-2023-52425).

Summary A security vulnerability has been disclosed in the Expat library libexpat, which is installed as part of IBM Tivoli Network Manager. Information about this vulnerability has been published in a security bulletin. Vulnerability Details CVEID:CVE-2023-52425 DESCRIPTION: libexpat is vulnerab...

EulerOS Virtualization 2.9.1 : openssh (EulerOS-SA-2024-1460)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote...

GHSA-VCC3-RW6F-JV97 Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xc9x-jj77-9p9j. This link is maintained to preserve external references. Original Description Summary Nokogiri upgrades its dependency libxml2 as follows: - v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6 - v1.16...

libxml2: use-after-free in XMLReader

A use-after-free flaw was found in libxml2. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free...

Fedora 38 : mingw-expat (2024-40b98c9ced)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-40b98c9ced advisory. Update to 2.6.1, backport fix for CVE-2024-28757. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...