showdoc 跨站脚本漏洞

showdoc is open source a great tool for IT teams to share documents online. A security vulnerability exists in showdoc before 2.10.2. The vulnerability allowed .xml to store cross-site scripting attack payloads via uploaded attachments in the format found in the document library...

CVE-2022-26661

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

UBUNTU-CVE-2022-26662

An XML Entity Expansion XEE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. A...

PYSEC-2022-43171

An XML Entity Expansion XEE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. A...

PYSEC-2022-43170

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

Mozilla: Use-after-free in XSLT parameter processing

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Removing an XSLT parameter during processing could have led to an exploitable use-after-free issue. There were reports of attacks in the wild abusing this flaw...

expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution

A flaw was found in expat. Passing one or more namespace separator characters in the "xmlns:prefix" attribute values made expat send malformed tag names to the XML processor on top of expat. This issue causes arbitrary code execution depending on how unexpected cases are handled inside the XML...

expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution

A flaw was found in expat. Passing one or more namespace separator characters in the "xmlns:prefix" attribute values made expat send malformed tag names to the XML processor on top of expat. This issue causes arbitrary code execution depending on how unexpected cases are handled inside the XML...

Fixed vulnerability in Wi-Fi SAE and EAP-wd implementations

A vulnerability has been fixed in implementations of the Simultaneous Authentication of Equals SAE and Extensible-Authentication-Protocol-EAP EAP-wd that are used in hostapd and wpasupplicant. The vulnerability enables a malicious party with the ability to execute code on the system to gain acces...

The vulnerability of the SdHostDriver component in the InsydeH2O UEFI firmware creation framework allows a attacker to execute arbitrary code on the target system.

The vulnerability of the SdHostDriver component in the InsydeH2O UEFI firmware creation framework is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code on the target system...

The vulnerability of the FvbServicesRuntimeDxe component in the InsydeH2O UEFI firmware creation framework allows a attacker to escalate their privileges.

The vulnerability of the FvbServicesRuntimeDxe component in the InsydeH2O UEFI firmware creation framework is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

CVE-2020-14478

A local, authenticated attacker could use an XML External Entity XXE attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitrarily read any local file via system-lev...

USN-5293-2 c3p0 vulnerability

USN-5293-1 fixed a vulnerability in c3p0. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to modify the application's XML configuration file could...

CVE-2021-39297

Potential vulnerabilities have been identified in UEFI firmware BIOS for some PC products which may allow escalation of privilege and arbitrary code execution...

Important: ruby:2.5 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source CVE-2020-36327 For more detail...

[SECURITY] Fedora 35 Update: protobuf-3.14.0-7.fc35

Protocol Buffers are a way of encoding structured data in an efficient yet extensible format. Google uses Protocol Buffers for almost all of its internal RPC protocols and file formats. Protocol buffers are a flexible, efficient, automated mechanism for serializing structured data...

Hp Uefi 安全漏洞

Hp Uefi is a Unified Extensible Firmware Interface from Hewlett-Packard Hp. It is a method of handling the computer before loading the operating system. Hp Uefi has a security vulnerability that stems from a problem in the UEFI firmware BIOS that could allow privileged escalation and arbitrary co...

PT-2022-10894 · Amd · System Management Mode

Name of the Vulnerable Software and Affected Versions: AMD System Management Mode SMM affected versions not specified UEFI firmware BIOS for some PC products affected versions not specified Description: A potential issue in AMD System Management Mode SMM interrupt handler may allow an attacker wi...

Hp Uefi 安全漏洞

Hp Uefi is a Unified Extensible Firmware Interface from Hewlett-Packard Hp. It is a method of handling the computer before loading the operating system. Hp Uefi has a security vulnerability that stems from a problem in the UEFI firmware BIOS that could allow privileged escalation and arbitrary co...

Hp Uefi 安全漏洞

Hp Uefi is a Unified Extensible Firmware Interface from Hewlett-Packard Hp. It is a method of handling the computer before loading the operating system. Hp Uefi has a security vulnerability that stems from a problem in the UEFI firmware BIOS that could allow privileged escalation and arbitrary co...