The vulnerability of the PJSIP multimedia communication library, related to executing a loop with an unavailable exit condition, allows attackers to cause service failures.

The vulnerability of the PJSIP multimedia communication library is related to the execution of a loop with an unavailable exit condition during syntactic analysis of XML files. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2022-11716 · Mini-Xml · Mini-Xml

Name of the Vulnerable Software and Affected Versions: Mini-XML version 3.2 Description: A stack buffer overflow exists in Mini-XML. When inputting an unformed XML string to the "mxmlLoadString" API, it will cause a stack-buffer-overflow in mxml string getc. Note that it is unclear whether this...

expat: Integer overflow in lookup in xmlparse.c

expat libexpat is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability,...

The vulnerability of the software import function of Cisco Enterprise NFV Infrastructure Software (NFVIS) allows a hacker to disclose protected information.

The vulnerability of the Cisco Enterprise NFV Infrastructure Software’s software import function NFVIS is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information using specially created...

Cross-site Scripting (XSS)

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization, via XML. Details Cross-site scripting or XSS is a code...

GHSA-8GWC-X7MG-7P7P Apache XML Security For Java vulnerable to Infinite Loop

Affected versions of xmlsec are subject to a denial of service vulnerability. Should a user check the signature of a message larger than 512 MB, the method expandSizeint newPos of class org.apache.xml.security.utils.UnsyncByteArrayOutputStream goes in an endless loop. A remote attacker could use...

GHSA-254Q-RP36-V2M8 Missing XML Validation in Apache CXF

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service CPU and memory consumption via crafted XML with a large number of 1 elements, 2 attributes, 3 nested constructs, and possibly other vectors...

CVE-2021-27777

XML External Entity XXE injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references...

CVE-2021-23792

The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity XXE Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file e.g. when an online profile...

Apache Jena 代码问题漏洞

Apache Jena is a Java Semantic Web framework from the U.S. Apache Apache Foundation. It is used to build semantic Web and linked data applications. Apache Jena suffers from an XML external entity injection vulnerability, which stems from a Web system or product that does not set the correct filte...

GHSA-8HFM-837H-HJG5 Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in multiple products. The Apache XML Security Java is affected by the vulnerability published in US-Cert VU 466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow ...

XWiki Commons代码问题漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from a script that can access any file service accessed by a user running an XWiki application server via XML script injection via XML external entities...

libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode

A NULL pointer dereference flaw was found in libxml2, where it did not propagate errors while parsing XML mixed content. This flaw causes the application to crash if an untrusted XML document is parsed in recovery mode and post validated. The highest threat from this vulnerability is to system...

The vulnerability of the wddx_stackdestroy function in the PHP programming language allows a hacker to trigger a service failure or potentially cause other effects.

The vulnerability of the wddxstackdestroy function ext/wddx/wddx.c in the PHP programming language is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause service interruptions or potentially have other effects through an XML documen...

The vulnerability of the ext/wddx/wddx.c component of the PHP interpreter allows a attacker to cause a service failure.

The vulnerability of the ext/wddx/wddx.c component of the PHP programming language interpreter is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause service failures by sending invalid XML documents...

FANUC ROBOGUIDE 代码问题漏洞

FANUC ROBOGUIDE is a robot simulation software from FANUC Japan. FANUC ROBOGUIDE v9.40083.00.05 and earlier versions exist XML external entity injection vulnerability, which originates from the lack of application restrictions on external entities. An attacker could exploit this vulnerability to...

PT-2022-2397 · Apache · Apache Superset

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 1.4.2 Description: The issue is related to a lack of validation of XML object sequences, which can be exploited by a remote attacker to conduct SQL injection attacks. This can occur in chart data requests. Th...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc. A security vulnerability previously existed in Google Chrome version 109.0.5414.119, which stemmed from an improperly implemented vulnerability in the XML implementation...

The vulnerability of the XML syntax analyzer library libexpat, related to integer overflow, allows an attacker to execute arbitrary code.

The vulnerability of the XML syntax analyzer library libexpat is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted data...

The vulnerability of the XML DOM implementation lies in the lack of mechanisms for encoding or escaping output data, allowing attackers to compromise the integrity of the data.

The vulnerability of the XML DOM implementation is related to improper filtering of special characters. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...