The vulnerability of Google Chrome’s browser loading function, related to memory usage after it is released, allows a hacker to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of Google Chrome’s web browser loading function is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions through a specially created...

Antenna House Office Server Document Converter 代码问题漏洞

Antenna House Office Server Document Converter Osdc is an office server document converter from Antenna House USA. It is used to batch convert Word, Excel and Powerpoint into high quality Pdf or image formats that are easy to share and look accurate on any screen. A code issue vulnerability exist...

Google Chrome 安全特征问题漏洞

Chrome is a web browsing tool developed by Google. versions prior to Google Chrome 95.0.4638.54 are vulnerable to an improper Blink implementation. An attacker could exploit this vulnerability to abuse content security policies via crafted HTML pages...

Google Chrome 资源管理错误漏洞

Chrome is a web browsing tool developed by Google. a post-release reuse vulnerability exists in Profiles in versions prior to Google Chrome 95.0.4638.54. A remote attacker exploited this vulnerability to potentially exploit heap corruption via a crafted HTML page...

USN-5110-1 ardour vulnerability

It was discovered that Ardour incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

TinyXML 安全漏洞

TinyXML is a C++ XML parser that can be easily integrated into other programs. An infinite loop vulnerability exists in TiXmlParsingData::Stamp in tinyxmlparser.cpp in TinyXML 2.6.2 and earlier. An attacker can exploit this vulnerability to cause a denial of service via a specially crafted XML...

Cisco Identity Services Engine 代码问题漏洞

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform regulates the network by collecting real-time information from the network, users, and devices to develop and enforce policies. A code issue vulnerability...

PT-2021-18096 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 10.9 and below Description: The issue allows a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account through an XML Signature Wrapping Attack. It is...

Google Chrome 资源管理错误漏洞

Chrome is a simple and efficient web browsing tool developed by Google. a post-release reuse vulnerability exists in V8 in versions prior to Google Chrome 94.0.4606.71. An attacker could exploit this vulnerability to potentially cause heap corruption via a crafted HTML page...

VMware vCenter Server 资源管理错误漏洞

VMware vCenter Server is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. A resource management error vulnerability...

golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader

An infinite loop vulnerability was found in golang. If an application defines a custom token parser initializing with xml.NewTokenDecoder it is possible for the parsing loop to never return. An attacker could potentially craft a malicious XML document which has an XML element with EOF within it,...

CVE-2021-30137

Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points...

Axios Systems Assyst 代码问题漏洞

Axios Systems Assyst is an off-the-shelf application from UK-based Axios Systems for managing IT services without the complexity and overhead associated with ITSM platforms such as ServiceNow and BMC Remedy. Axios Systems Assyst version 10 SP7.5 suffers from a security vulnerability that stems fr...

body-parser-xml 代码问题漏洞

body-parser-xml is an XML body parser that converts incoming XML data into a JSON representation. a code issue vulnerability exists in body-parser-xml, which stems from an error in the product's implementation of certain functionality. No details of the vulnerability are currently available...

JEESNS 跨站脚本漏洞

JEESNS is a social management system developed on the JAVA enterprise platform. An attacker can use this vulnerability to execute arbitrary Web scripts or HTML...

JEESNS 跨站脚本漏洞

JEESNS is a social management system developed on the JAVA enterprise platform. The vulnerability can be exploited to execute arbitrary Web script or HTML via a specially crafted payload in the header...

Mozilla Firefox 缓冲区错误漏洞

Mozilla Firefox is an open source Web browser from the Mozilla Foundation, U.S. A buffer overflow vulnerability exists in Mozilla Firefox, which stems from a boundary error in the product's handling of HTML content. A remote attacker could exploit the vulnerability to create a specially crafted W...

USN-5061-1 scilab vulnerabilities

It was discovered that Scilab did not properly sanitize XML inputs. An atacker could use a crafted XML file to cause a denial of service or possibly execute arbitrary code...

UBUNTU-CVE-2021-30596

Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

UBUNTU-CVE-2021-39371

An XML external entity XXE injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected...