EUVD-2026-70645

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

CVE-2026-4813: Improper Control of Generation of Code

A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

...

CVE-2024-31573: Incorrect Resource Transfer Between Spheres

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension functions are enabled...

CVE-2024-31573

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension functions are enabled...

Function collision between extension functions and account functions

Lines of code Vulnerability details Impact Users or owner can't use extensions because of collision between extension functions and account functions Proof of Concept Whenever someone calls account it will check for functions inside it, if there isn't function it goes to fallback to check...

Collection 安全漏洞

Collection is a minimalist JavaScript library for working with collections of data by the individual developer kobezzza. A security vulnerability exists in Collection versions prior to 6.8.1, which stems from prototype contamination via extension functions in...

Kotlin DSLs in the world of Springdom

Kotlin is a beautiful language that makes it trivial to take old Java libraries and make them much more concise, just by virtue of the Kotlin syntax itself. It shines, however, when you write DSLs. Here's some inside baseball for you: the Spring teams do their level-headed best to be cohesive, to...

PYSEC-2014-83

The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf...

PT-2013-1727

Name of the Vulnerable Software and Affected Versions IBM Cognos Business Intelligence BI versions 8.4.1 through 8.4.1 before IF1 IBM Cognos Business Intelligence BI versions 10.1 through 10.1 before IF2 IBM Cognos Business Intelligence BI versions 10.1.1 through 10.1.1 before IF2 IBM Cognos...

CVE-2012-4840: Improper Control of Generation of Code

IBM Cognos Business Intelligence BI 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to conduct XPath injection attacks, and call XPath extension functions, via unspecified vectors...

Google Chrome multiple vulnerabilities - March 11 (Windows)

The host is running Google Chrome and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbgooglechromemultvulnmar11win.nasl 7044 2017-09-01 11:50:59Z teissa $ Google Chrome multiple vulnerabilities - March 11 Windows Authors: Sooraj KS Copyright: Copyright c 2011 Greenbone...

Design/Logic Flaw

Google Chrome before 9.0.597.107 does not properly restrict access to internal extension functions, which has unspecified impact and remote attack vectors...

CVE-2011-1123

Google Chrome before 9.0.597.107 does not properly restrict access to internal extension functions, which has unspecified impact and remote attack vectors...

Google Fixes 19 Bugs in Chrome, Pays $14K in Bug Bounties

Google has released version 9.0.597.107 of its Chrome browser, fixing 19 security vulnerabilities and paying $14,000 in rewards to researchers in the process. The new version of Chrome, which Google released on Monday afternoon, includes fixes for 16 high-severity vulnerabilities and three bugs...

CVE-2011-1123: Incorrect Authorization

Google Chrome before 9.0.597.107 does not properly restrict access to internal extension functions, which has unspecified impact and remote attack vectors...

PT-2011-2888

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 9.0.597.107 Description The issue is related to improper restriction of access to internal extension functions in Google Chrome, allowing for remote attack vectors. The impact of this issue is not specified...

CVE-2009-1088: Improper Control of Generation of Code

Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Java code via a crafted XSLT stylesheet with "extension elements and extension functions" that trigger code execution by Xalan-Java, as demonstrated using xalan://java.lang.Runtime...