DDMAL MEI2Volpiano 代码问题漏洞

MEI2Volpiano is an open source Python library from DDMAL Canada. It is used to convert Neume and CWMN MEI files to Volpiano strings. A security vulnerability exists in DDMAL MEI2Volpiano version 0.8.2, which stems from the use of the insecure xml.etree library to parse untrusted XML inputs...

The vulnerability of the Xstream Java library for converting objects to XML or JSON format allows a malicious actor to cause a service failure due to uncontrolled resource consumption.

The vulnerability of the Xstream library for converting objects into XML or JSON format involves an uncontrolled resource consumption. Exploiting this vulnerability may allow a malicious actor to cause service failures remotely...

UBUNTU-CVE-2022-0217

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs CWE-776. In addition, depending on the libexpa...

Stack exhaustion from deeply nested XML documents in encoding/xml

...

AZL-10536 CVE-2022-30633 affecting package golang for versions less than 1.18.5-1

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag...

CVE-2022-28131

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document...

dotnet: External Entity Injection during XML signature verification

An information disclosure vulnerability exists in .NET Core and .NET. This issue can lead to unauthorized access to privileged information...

dotnet: External Entity Injection during XML signature verification

An information disclosure vulnerability exists in .NET Core and .NET. This issue can lead to unauthorized access to privileged information...

PT-2022-16733 · Red Hat +1 · Kie-Server Apis +1

Name of the Vulnerable Software and Affected Versions: Business Central affected versions not specified Kie-Server APIs affected versions not specified Description: The issue allows an attacker to interfere with an application's processing of XML data through XML external entity injection XXE. Th...

PT-2022-4896 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.3-p2 and earlier Adobe Commerce versions 2.3.7-p3 and earlier Adobe Commerce versions 2.4.4 and earlier Description: The issue is related to errors in processing XML requests, which can allow a remote attacker to...

golang: encoding/xml: stack exhaustion in Unmarshal

A flaw was found in golang. Calling Unmarshal on an XML document into a Go struct, which has a nested field that uses the "any" field tag, can cause a panic due to stack exhaustion...

[SECURITY] Fedora 36 Update: golang-github-ajstarks-deck-0-0.13.20210114git30c9fc6.fc36

Deck is a library for clients to make scalable presentations, using a standard markup language. Clients read deck files into the Deck structure, and traverse the structure for display, publication, etc. Clients may be interactive or produce standard formats such as SVG or PDF...

CVE-2022-2008

Double free in WebGL in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

PT-2022-17404 · Opc · Opc Labs Quickopc

Name of the Vulnerable Software and Affected Versions: OPC Labs QuickOPC version 2022.1 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fla...

DEBIAN-CVE-2022-1853

Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2022-1873

Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2022-1872

Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page...

PT-2022-20749 · Untangle · Untangle

Name of the Vulnerable Software and Affected Versions: untangle versions 1.2.0 and earlier Description: untangle is a python library to convert XML data to python objects. It improperly restricts XML external entity references, allowing a remote unauthenticated attacker to read the contents of...

OpenKM 代码问题漏洞

OpenKM is a document management system from OpenKM Spain. The system provides features such as version control, document history, and file sharing. A security vulnerability exists in OpenKM Community Edition version 6.3.10 and earlier versions. An attacker could exploit this vulnerability to...

untangle 安全漏洞

untangle is a package from the individual developer Christian Stefanescu in Germany. It is used to convert XML to Python objects. A security vulnerability exists in untangle, which stems from improper restriction of XML entities in DTDs. A remote attacker could use this vulnerability to send a...