The vulnerability of the IBM Sterling Partner Engagement Manager software lies in the improper limitation of XML links to external objects, which allows attackers to disclose protected information.

The vulnerability of the IBM Sterling Partner Engagement Manager software relates to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose sensitive information...

The vulnerability of the import function of the administrative interface module of Cisco Firepower Management Center software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the import function of the administrative interface module of Cisco Firepower Management Center FMC is related to insufficient validation of XML files’ syntax. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information through ...

Update now! Proof of concept code to be released for Zoho ManageEngine vulnerability

Users of multiple Zoho ManageEngine products are under urgent advice to install the patch issued October 27, 2022. The advice is urgent because on January 13, 2023 the Horizon3 Attack Team tweeted that Proof of Concept PoC code and a deep-dive blog will be released within a week. Mitigation A lon...

OpenStack 安全漏洞

OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA in the U.S. Swift is one of the storage projects used to store permanent static data. A security vulnerability exists in OpenStack that stems from the fact that by providing a specially...

Google Chrome 缓冲区错误漏洞

Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in versions of Google Chrome prior to 109.0.5414.74, which stems from a possible heap buffer overflow in its Network Service Allows an attacker to convince a user to install a malicious extensio...

USN-5796-1 w3m vulnerability

It was discovered that w3m incorrectly handled certain HTML files. A remote attacker could use this issue to cause w3m to crash, resulting in a denial of service, or possibly execute arbitrary code...

simplexrd 代码问题漏洞

simplexrd is a very simple XRD document parser by Kelvin Mo, a personal developer. A code issue vulnerability exists in versions of simplexrd prior to 3.1.1, which stems from a problem with unknown code in the file simplexrd/simplexrd.class.php, which can lead to xml external entity references...

iText 代码问题漏洞

iText is an open source library for creating and manipulating PDF files in Java. It is written by Bruno Lowagie, Paulo Soares and others. A code issue vulnerability exists in iText RUPS. An attacker exploits this vulnerability to cause xml external entity references...

PT-2022-27728 · Unknown · 3D City Database Ogc Web Feature Service

Name of the Vulnerable Software and Affected Versions: 3D City Database OGC Web Feature Service versions up to 5.2.1 Description: A vulnerability was found in the 3D City Database OGC Web Feature Service, which affects some unknown processing and leads to xml external entity reference. The...

FeehiCMS 跨站脚本漏洞

FeehiCMS is a Php-based CMS website builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.1.1, which originated from a vulnerability that allows remote attackers to run arbitrary code by uploading a carefully crafted XML file...

PT-2022-9009 · Feehicms · Feehicms

Name of the Vulnerable Software and Affected Versions: FeehiCMS version 2.0.8 Description: The issue allows remote attackers to run arbitrary code via the lang attribute of an HTML tag. This is a Cross Site Scripting XSS issue, which enables attackers to execute scripts in the context of another...

pki-core: access to external entities when parsing XML can lead to XXE

A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...

The vulnerability of the XML method access determination module and XMLDOM, related to insufficient validation of input data, allows a malicious actor to gain unauthorized access to the application.

The vulnerability of the XML method access determination module and its XMLDOM control mechanism is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the application by sending specially crafte...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A type obfuscation vulnerability exists in versions of Google Chrome prior to V8 108.0.5359.71, which can be exploited by remote attackers to launch an attack via a crafted HTML page using heap corruption...

XSS in Desktop Client in the notifications

None...

CVE-2022-39332

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for...

PT-2022-24906 · Nextcloud +2 · Nextcloud Desktop Client +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop client versions prior to 3.6.1 Description: An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. There are no known workarounds for this issue. Recommendations: For versions prior t...

CVE-2022-39332 Cross-site scripting (XSS) in Nextcloud Desktop Client

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for...

ZOHO ManageEngine ServiceDesk Plus 代码问题漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management, IT Project Management, Procurement and Contract Management, and...

PT-2022-27310 · Unknown · Appalti & Contratti

Name of the Vulnerable Software and Affected Versions: Appalti & Contratti version 9.12.2 Description: The web application is vulnerable to a Reflected Cross-Site Scripting issue. The idPagina parameter is reflected inside the server response without any HTML encoding, resulting in XSS when the...