1037 matches found
Stack exhaustion from deeply nested XML documents in encoding/xml
...
AZL-10536 CVE-2022-30633 affecting package golang for versions less than 1.18.5-1
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag...
CVE-2022-28131
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document...
dotnet: External Entity Injection during XML signature verification
An information disclosure vulnerability exists in .NET Core and .NET. This issue can lead to unauthorized access to privileged information...
dotnet: External Entity Injection during XML signature verification
An information disclosure vulnerability exists in .NET Core and .NET. This issue can lead to unauthorized access to privileged information...
PT-2022-4896 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.3-p2 and earlier Adobe Commerce versions 2.3.7-p3 and earlier Adobe Commerce versions 2.4.4 and earlier Description: The issue is related to errors in processing XML requests, which can allow a remote attacker to...
PT-2022-16733 · Red Hat +1 · Kie-Server Apis +1
Name of the Vulnerable Software and Affected Versions: Business Central affected versions not specified Kie-Server APIs affected versions not specified Description: The issue allows an attacker to interfere with an application's processing of XML data through XML external entity injection XXE. Th...
golang: encoding/xml: stack exhaustion in Unmarshal
A flaw was found in golang. Calling Unmarshal on an XML document into a Go struct, which has a nested field that uses the "any" field tag, can cause a panic due to stack exhaustion...
PT-2022-20749 · Untangle · Untangle
Name of the Vulnerable Software and Affected Versions: untangle versions 1.2.0 and earlier Description: untangle is a python library to convert XML data to python objects. It improperly restricts XML external entity references, allowing a remote unauthenticated attacker to read the contents of...
untangle 安全漏洞
untangle is a package from the individual developer Christian Stefanescu in Germany. It is used to convert XML to Python objects. A security vulnerability exists in untangle, which stems from improper restriction of XML entities in DTDs. A remote attacker could use this vulnerability to send a...
untangle 代码问题漏洞
untangle is a package from the individual developer Christian Stefanescu in Germany. It is used to convert XML to Python objects. A code issue vulnerability exists in untangle that stems from insufficient validation of user-supplied XML input...
OpenKM 代码问题漏洞
OpenKM is a document management system from OpenKM Spain. The system provides features such as version control, document history, and file sharing. A security vulnerability exists in OpenKM Community Edition version 6.3.10 and earlier versions. An attacker could exploit this vulnerability to...
CVE-2022-32458
Digiwin BPM has a XML External Entity Injection XXE vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files...
Business-central 代码问题漏洞
Business-central is a software package. A security vulnerability exists in Business-central that stems from the possibility of receiving an XML external entity injection attack...
UBUNTU-CVE-2022-31213
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file...
SAP Business One 代码问题漏洞
SAP Business One is a set of enterprise management software from SAP. The software includes functions such as financial management, operations management and human resource management. A denial-of-service vulnerability exists in SAP Business One version 10.0, which stems from improper input clean...
xml-security: XPath Transform abuse allows for information disclosure
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...
php: Special character breaks path in xml parsing
A flaw was found in php. The main cause of this vulnerability is improper input validation while parsing an Extensible Markup LanguageXML entity. A special character could allow an attacker to traverse directories. The highest threat from this vulnerability is confidentiality...
WordPress plugin Import any XML or CSV File 代码问题漏洞
WordPress is a blogging platform developed using the PHP language. WordPress Import any XML or CSV File plugin versions prior to 3.6.8 are vulnerable to arbitrary file uploads, which originate from accepting all zip files and automatically extracting the zip file without validating the extracted...