25 matches found
RHLW-2026-EA9F6FE6976A39AA Lightwell Security Advisory: xmlunit-core 2.8.4.rhlw-00001
Red Hat Lightwell has released org.xmlunit:xmlunit-core 2.8.4.rhlw-00001 with a backported security fix. CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension...
RHLW-2026-BF51D193D76DE6EF Lightwell Security Advisory: xmlunit-assertj3 2.9.1.rhlw-00002
Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.9.1.rhlw-00002 with a backported security fix. CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension...
RHLW-2026-DE2BB03E40C2EC86 Lightwell Security Advisory: xmlunit-assertj3 2.8.4.rhlw-00001
Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.8.4.rhlw-00001 with a backported security fix. CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension...
EUVD-2026-70645
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...
CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...
CVE-2026-58400
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing "FEATURESECUREPROCESSING" and without disabling Java extension functions...
CVE-2026-4813
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...
CVE-2026-4813: Improper Control of Generation of Code
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
...
CVE-2024-31573
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension functions are enabled...
CVE-2024-31573
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension functions are enabled...
CVE-2024-31573: Incorrect Resource Transfer Between Spheres
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension functions are enabled...
Function collision between extension functions and account functions
Lines of code Vulnerability details Impact Users or owner can't use extensions because of collision between extension functions and account functions Proof of Concept Whenever someone calls account it will check for functions inside it, if there isn't function it goes to fallback to check...
Collection Security Vulnerabilities
Collection is a minimalist JavaScript library for working with collections of data by the individual developer kobezzza. A security vulnerability exists in Collection versions prior to 6.8.1, which stems from prototype contamination via extension functions in...
Kotlin DSLs in the world of Springdom
Kotlin is a beautiful language that makes it trivial to take old Java libraries and make them much more concise, just by virtue of the Kotlin syntax itself. It shines, however, when you write DSLs. Here's some inside baseball for you: the Spring teams do their level-headed best to be cohesive, to...
PYSEC-2014-83
The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf...
CVE-2012-4840: Improper Control of Generation of Code
IBM Cognos Business Intelligence BI 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to conduct XPath injection attacks, and call XPath extension functions, via unspecified vectors...
PT-2013-1727
Name of the Vulnerable Software and Affected Versions IBM Cognos Business Intelligence BI versions 8.4.1 through 8.4.1 before IF1 IBM Cognos Business Intelligence BI versions 10.1 through 10.1 before IF2 IBM Cognos Business Intelligence BI versions 10.1.1 through 10.1.1 before IF2 IBM Cognos...
Google Chrome multiple vulnerabilities - March 11 (Windows)
The host is running Google Chrome and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbgooglechromemultvulnmar11win.nasl 7044 2017-09-01 11:50:59Z teissa $ Google Chrome multiple vulnerabilities - March 11 Windows Authors: Sooraj KS Copyright: Copyright c 2011 Greenbone...
