XML Injection

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to XML Injection through the XML processing mechanism. An attacker can read arbitrary files on the system by crafting malicious XML input. Remediation...

PT-2023-5322 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p1 and earlier Adobe Commerce versions 2.4.5-p3 and earlier Adobe Commerce versions 2.4.4-p4 and earlier Description: The issue is related to errors in processing XML requests, which could allow a remote attacker...

CVE-2023-37497

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks XXE against the backend service...

DEBIAN-CVE-2022-4909

Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR bypass via a crafted HTML page. Chromium security severity: Low...

The vulnerability of the ezxml_internal_dtd function in the XML document syntax analysis library ezXML allows a attacker to cause a service failure.

The vulnerability of the ezxmlinternaldtd function in the XML document syntax analysis library ezXML is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially created XML file...

The vulnerability of the ezxml_parse_str function in the ezXML XML document syntax analysis library allows a attacker to cause a service failure.

The vulnerability of the ezxmlparsestr function in the ezXML XML syntax analysis library involves reading data beyond the allowable buffer size. Exploiting this vulnerability allows a malicious actor to cause service failures by using a specially created XML file...

Jenkins Plugin External Monitor Job Type 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PYSEC-2023-96

requests-xml v0.2.3 was discovered to contain an XML External Entity Injection XXE vulnerability which allows attackers to execute arbitrary code via a crafted XML file...

woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks

A flaw was found in the FasterXML/woodstox package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization. An attacker may benefit from the parser sending a malicious input that may cause a crash. This vulnerability is only relevant for users using the...

The vulnerability of the DecodeTreeBlock function in the XML data compression tool Xmill allows a hacker to execute arbitrary code.

The vulnerability of the DecodeTreeBlock function in the XML data compression tool Xmill is related to a memory boundary error during XML file processing. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of the PlainTextUncompressor::UncompressItem function in the XML data compression tool Xmill allows a attacker to execute arbitrary code.

The vulnerability of the PlainTextUncompressor::UncompressItem function in the XML data compression tool Xmill is related to a memory boundary error during XML file processing. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

The vulnerability of the DecodeTreeBlock function in the XML data compression tool Xmill allows a hacker to execute arbitrary code.

The vulnerability of the DecodeTreeBlock function in the XML data compression tool Xmill is related to a memory boundary error during XML file processing. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

jettison: parser crash by stackoverflow

A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input,...

XML Injection

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to XML Injection through the XML processing mechanism. An attacker can bypass security features by sending a specially crafted XML script. Remediation...

GHSA-GPV5-7X3G-GHJV fast-xml-parser regex vulnerability patch could be improved from a safety perspective

Summary This is a comment on https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw and the patches fixing it. Details The code which validates a name calls the validator:...

GHSA-P2QF-9VP6-3JJQ HuTool XML parsing module has blind XXE vulnerability

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference...

xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization...

jettison: memory exhaustion via user-supplied XML or JSON data

A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack...

dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML

A flaw was found in dotnet. This issue can allow bypass restrictions when deserializing a DataSet or DataTable from XML...

Fuji Electric FRENIC RHC Loader XML External Entity Reference Vulnerability

Fuji Electric FRENIC RHC Loader is a software tool developed by Fuji Electric Japan for debugging and monitoring inverters, mainly serving the industrial automation field. The Fuji Electric FRENIC RHC Loader suffers from an XML external entity reference vulnerability that can be exploited by an...