PT-2020-9930 · Eclipse · Eclipse Web Tools Platform

Name of the Vulnerable Software and Affected Versions: Eclipse Web Tools Platform versions prior to 3.18 2020-06 Description: The issue allows XML and DTD files referring to external entities to be exploited, sending the contents of local files to a remote server when edited or validated. This ca...

Rockwell Automation Logix Designer Studio 5000 Code Issue Vulnerability

Rockwell Automation Logix Designer Studio 5000 is the United States Rockwell Rockwell Automation company's set of logic controller programming software. A code issue vulnerability exists in Rockwell Automation Logix Designer Studio 5000 version 32.00, version 32.01, and version 32.02, which arise...

Jeesite suffers from an XML entity injection vulnerability

JeeSite is an enterprise information technology development infrastructure platform , Java enterprise applications open source framework. Jeesite has an XML entity injection vulnerability that can be exploited by attackers to obtain sensitive information...

expat: large number of colons in input makes parser consume high amount of resources, leading to DoS

It was discovered that the "setElementTypePrefix" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of service...

expat: large number of colons in input makes parser consume high amount of resources, leading to DoS

It was discovered that the "setElementTypePrefix" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of service...

expat: heap-based buffer over-read via crafted XML input

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read...

The vulnerability of the /rpc/api component of the Red Hat Spacewalk system management software allows a attacker to disclose sensitive information, cause service failures, or execute arbitrary code.

The vulnerability of the /rpc/api component of the Red Hat Spacewalk software suite relates to incorrect restrictions on XML links to external objects. Exploitation of this vulnerability could allow a malicious actor to disclose sensitive information, cause service failures, or execute arbitrary...

Attentive Home Attentive Cat (imcat) suffers from an XML entity injection vulnerability

imcat is a PHP-based open source website building system . Thoughtful Home Thoughtful Cat imcat has an XML entity injection vulnerability that can be exploited by an attacker to gain control of the server...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

PostgreSQL JDBC Driver Code Issue Vulnerability

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A code issue exists in PostgreSQL JDBC Driver PgJDBC versions prior...

The vulnerability of the central control server of SiNVR 3 Central Control Server lies in security flaws in the XML-based communication protocol, allowing attackers to perform arbitrary actions on the vulnerable device.

The vulnerability of the central control server of SiNVR 3 Central Control Server is related to security vulnerabilities in the XML-based communication protocol. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely...

The vulnerability of the XML analyzer for software that manages Cisco Firepower Device Manager On-Box allows a hacker to trigger a maintenance failure.

The vulnerability of the XML analyzer for software that manages Cisco Firepower Device Manager On-Box devices is related to an operation where data escapes beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failure...

USN-4337-1 openjdk-8, openjdk-lts vulnerabilities

It was discovered that OpenJDK incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service while processing a specially crafted regular expression. CVE-2020-2754, CVE-2020-2755 It was discovered that OpenJDK incorrectly handled class...

SAP Commerce Input Validation Error Vulnerability

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. The product supports sales management, marketing management, order management and operations management. An input validation error vulnerability exists in SAP Commerce that stems from the Rest API program not securely...

CVE-2020-10629

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

Advantech WebAccess/NMS Input Validation Error Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. An input validation error vulnerability exists in Advantech WebAccess/NMS, which can be exploited by an attacker to obtain sensitive information via specially crafted XML input...

CVE-2019-4391

HCL AppScan Standard is vulnerable to XML External Entity Injection XXE attack when processing XML data...

bima.co.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1117089 Security Researcher g0bl1nsec Helped patch 3759 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bima.co.uk website and it...

WAGO PFC200 Command Injection Vulnerability (CNVD-2020-16840)

The WAGO PFC200 is a programmable logic controller PLC from WAGO Germany. A command injection vulnerability exists in the iocheckd service 'I/O-Check' function of the WAGO PFC200 03.02.0214. An attacker can exploit this vulnerability to inject OS commands via specially crafted XML cache files...

WAGO PFC200 Command Injection Vulnerability (CNVD-2020-16848)

The WAGO PFC200 is a programmable logic controller PLC from WAGO Germany. A command injection vulnerability exists in the iocheckd service 'I/O-Check' function of the WAGO PFC200 03.02.0214. An attacker can exploit this vulnerability to inject OS commands via specially crafted XML cache files...