3886 matches found
GHSA-VCC3-RW6F-JV97 Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xc9x-jj77-9p9j. This link is maintained to preserve external references. Original Description Summary Nokogiri upgrades its dependency libxml2 as follows: - v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6 - v1.16...
libxml2: use-after-free in XMLReader
A use-after-free flaw was found in libxml2. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free...
Fedora 38 : mingw-expat (2024-40b98c9ced)
The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-40b98c9ced advisory. Update to 2.6.1, backport fix for CVE-2024-28757. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...
Fedora 39 : mingw-expat (2024-4e6e660fae)
The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-4e6e660fae advisory. Update to 2.6.1, backport fix for CVE-2024-28757. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...
Ubuntu 22.04 LTS / 23.10 : Expat vulnerabilities (USN-6694-1)
The remote Ubuntu 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6694-1 advisory. It was discovered that Expat could be made to consume large amounts of resources. If a user or automated system were tricked into processing...
SUSE CVE-2024-28757
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...
Slackware Linux 15.0 / current expat Vulnerability (SSA:2024-073-01)
The version of expat installed on the remote host is prior to 2.6.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-073-01 advisory. - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via...
CVE-2024-22044
A vulnerability has been identified in SENTRON 3KC ATC6 Expansion Module Ethernet 3KC9000-8TL75 All versions. Affected devices expose an unused, unstable http service at port 80/tcp on the Modbus-TCP Ethernet. This could allow an attacker on the same Modbus network to create a denial of service...
CVE-2024-22044
A vulnerability has been identified in SENTRON 3KC ATC6 Expansion Module Ethernet 3KC9000-8TL75 All versions. Affected devices expose an unused, unstable http service at port 80/tcp on the Modbus-TCP Ethernet. This could allow an attacker on the same Modbus network to create a denial of service...
Siemens SENTRON 3KC ATC6 Expansion Module Ethernet 安全漏洞
The Siemens SENTRON 3KC ATC6 Expansion Module is a power distribution protection device from Siemens, Germany, for monitoring and protecting power systems. A hidden function vulnerability exists in the Siemens SENTRON 3KC ATC6 Ethernet Module due to affected devices exposing unused and unstable...
XML Entity Expansion
libexpat is vulnerable to XML Entity Expansion. The vulnerability is caused due to insufficient input validation and handling of external entities in the XML parser. This allows an attacker to perform an XML Entity Expansion attack...
CVE-2024-28757
An XML Entity Expansion flaw was found in libexpat. This flaw allows an attacker to cause a denial of service when there is an isolated use of external parsers...
DEBIAN-CVE-2024-28757
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...
CVE-2024-28757
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...
AZL-35841 CVE-2024-28757 affecting package expat for versions less than 2.6.2-2
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...
ALPINE-CVE-2024-28757
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...
AZL-35880 CVE-2024-28757 affecting package expat for versions less than 2.6.2-1
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...
CVE-2024-28757
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...
CVE-2024-28757
The CVE-2024-28757 entry concerns libexpat up to version 2.6.1, where XML External Entity (XXE) processing can be triggered when isolated external parsers are used (XML_ExternalEntityParserCreate). The impact is denial of service or resource exhaustion (availability impact: HIGH) with CVSS v3.1 b...