The vulnerability of the Adobe XMP-Toolkit-SDK software, related to breaching the initial buffer boundary, allows a perpetrator to execute arbitrary code in the context of the current user.

The vulnerability of the Adobe XMP-Toolkit-SDK lies in the violation of the buffer’s initial boundary. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in the context of the current user, through a specially created application...

The vulnerability of the Mozilla Firefox browser, related to security configuration errors, allows attackers to circumvent existing security restrictions.

The vulnerability of the Mozilla Firefox browser is related to errors in the configuration of security rules for iframe-based tables in XSLT stylesheets. Exploiting this vulnerability allows an attacker to circumvent existing security restrictions by using iframes to bypass limitations such as...

The vulnerability of the corporate application store server, Citrix StoreFront, allows attackers to perform XXE attacks.

The vulnerability of the corporate application store server Citrix StoreFront is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

CVE-2021-0071

Improper input validation in firmware for some IntelR PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats allows attackers to download files of dangerous types indefinitely. This enables attackers to upload and execute arbitrary code from a remote host.

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability could allow an attacker to download and execute arbitrary code from a remote host by...

The vulnerability of the Adobe XMP-Toolkit-SDK software, related to buffer overflows in the stack, allows a hacker to execute arbitrary code.

The vulnerability of the Adobe XMP-Toolkit-SDK software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats allows a hacker to cause a service failure due to uncontrolled resource consumption.

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to an uncontrolled resource consumption. Exploiting this vulnerability may allow a malicious actor to cause a service failure by consuming excessive resources on the central processor...

PT-2021-14732 · Jenkins · Jenkins Perforce Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Performance Plugin versions 3.20 and earlier Description: The issue is related to the XML parser not being configured to prevent XML external entity XXE attacks. This allows attackers who can control workspace contents to have Jenkins...

Eclipse Cyclone DDS 代码问题漏洞

Eclipse Cyclone DDS is a very high performance and robust open source DDS implementation from the Eclipse Foundation. A code issue vulnerability exists in Eclipse Cyclone DDS that stems from the product's failure to properly handle write-what-where logic. The vulnerability allows an attacker to...

The vulnerability of the software for creating metadata, processing, and exchanging data according to the Adobe XMP-Toolkit-SDK standards, related to reading beyond the buffer in memory, allows attackers to disclose protected information.

The vulnerability of the software for creating metadata, processing, and exchanging data according to the Adobe XMP-Toolkit-SDK is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

edk2: unlimited FV recursion, round 2

A flaw was found in edk2. An unlimited recursion in DxeCore may allow an attacker to corrupt the system memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Mozilla: iframe sandbox rules did not apply to XSLT stylesheets

The Mozilla Foundation Security Advisory describes this flaw as: The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame...

Mozilla Firefox 安全特征问题漏洞

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to a security feature problem in which iframe sandboxing rules are not properly applied to XSLT style sheets and an attacker can use the vulnerability to bypass implemented security restrictio...

Antenna House Office Server Document Converter 代码问题漏洞

Antenna House Office Server Document Converter Osdc is an office server document converter from Antenna House USA. It is used to batch convert Word, Excel and Powerpoint into high quality Pdf or image formats that are easy to share and look accurate on any screen. A code issue vulnerability exist...

The vulnerability of the VXLAN Operation, Administration, and Maintenance (OAM) function of the Cisco NX-OS operating system allows a attacker to trigger a maintenance failure.

The vulnerability of the VXLAN Operation, Administration, and Maintenance OAM function of the Cisco NX-OS operating system is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to trigger maintenance failures remotely...

USN-5110-1 ardour vulnerability

It was discovered that Ardour incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

[SECURITY] Fedora 33 Update: httpd-2.4.51-1.fc33

The Apache HTTP Server is a powerful, efficient, and extensible web server...

[SECURITY] Fedora 35 Update: httpd-2.4.51-2.fc35

The Apache HTTP Server is a powerful, efficient, and extensible web server...

TinyXML 安全漏洞

TinyXML is a C++ XML parser that can be easily integrated into other programs. An infinite loop vulnerability exists in TiXmlParsingData::Stamp in tinyxmlparser.cpp in TinyXML 2.6.2 and earlier. An attacker can exploit this vulnerability to cause a denial of service via a specially crafted XML...

CVE-2021-41130

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-API-UserInfo", the application can use ...