CVE-2022-3244

The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access some of the plugin features if they manage to get the related nonce...

WordPress Plugin Import all XML, CSV & TXT SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Import all XML, CSV & TXT ...

Fedora: Security Advisory for weechat (FEDORA-2022-b81c4781af)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Dell BIOS 输入验证错误漏洞

Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell USA. A security vulnerability exists in Dell BIOS that stems from incorrect input validation. An attacker could exploit the vulnerability to modify UEFI variables...

SAP 3D Visual Enterprise Author 缓冲区错误漏洞

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A buffer overflow vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management and can be exploited by an attacker to...

Polycom RealPresence Resource Manager 安全漏洞

Polycom RealPresence Resource Manager is a device management software from Polycom USA. It provides centralized management of all your support devices, from mobile devices to desktops and conference phones, through video conference room systems and telepresence. A security vulnerability exists in...

[SECURITY] Fedora 35 Update: enlightenment-0.25.4-1.fc35

Enlightenment window manager is a lean, fast, modular and very extensible win dow manager for X11 and Linux. It is classed as a "desktop shell" providing the things you need to operate your desktop or laptop, but is not a whole ' application suite. This covered launching applications, managing...

OESA-2022-1966 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.CVE-2022-40307 A flaw use after free in the Linux kernel video4linux driver wa...

编号撤回

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. This CVE number has been withdrawn...

DEBIAN-CVE-2022-39835

An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...

CVE-2022-34348

IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 230017...

多款Acer产品缓冲区错误漏洞

Acer Aspire Series is a line of servers from Acer China. The security vulnerability in Acer products stems from the presence of a stack buffer overflow vulnerability, which could lead to the execution of arbitrary code in the UEFI DXE driver on certain Acer products. An attacker could elevate...

GHSA-X27M-9W8J-5VCW Jettison memory exhaustion

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack...

DEBIAN-CVE-2022-40151

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

UBUNTU-CVE-2022-40152

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

UBUNTU-CVE-2022-40150

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack...

An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.

...

DDMAL MEI2Volpiano 代码问题漏洞

MEI2Volpiano is an open source Python library from DDMAL Canada. It is used to convert Neume and CWMN MEI files to Volpiano strings. A security vulnerability exists in DDMAL MEI2Volpiano version 0.8.2, which stems from the use of the insecure xml.etree library to parse untrusted XML inputs...

The vulnerability of the Xstream Java library for converting objects to XML or JSON format allows a malicious actor to cause a service failure due to uncontrolled resource consumption.

The vulnerability of the Xstream library for converting objects into XML or JSON format involves an uncontrolled resource consumption. Exploiting this vulnerability may allow a malicious actor to cause service failures remotely...

The vulnerability affects the implementation of the XSLT (Extensible Stylesheet Language Transformations) technology in the Thunderbird email client, as well as in the Firefox and Firefox ESR browsers. This vulnerability allows an attacker to escalate their privileges.

The vulnerability of the XSLT technology implementation in the Thunderbird email client, as well as in browsers like Firefox and Firefox ESR, is related to an incorrect limitation on the number of visible layers or frames. Exploiting this vulnerability could allow a malicious actor to increase...