The vulnerability of the Chrome web browser’s angle library, allowing a hacker to execute arbitrary code

The vulnerability of the Chrome web browser’s angle library arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code, cause system failures, or disclose sensitive information through a specially...

DEBIAN-CVE-2018-19206

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of , as demonstrated by an onload attribute in a BODY element, within an HTML attachment...

The vulnerability of the XML file analyzer in the libxml2 library allows a hacker to trigger a service failure.

The vulnerability of the XML file analyzer in the libxml2 library arises from insufficient restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to cause service failures using a specially crafted XML document...

Google Chrome Extensions UI Spoofing Vulnerability

Google Chrome is a web browser developed by Google, Inc.Extensions is one of the browser extensions. A security vulnerability exists in Extensions in Google Chrome versions prior to 70.0.3538.67. The vulnerability can be exploited by remote attackers to spoof the contents of an extension pop-up...

The vulnerability of the PI Studio XML development tool analyzer arises from incorrect restrictions on XML references to external objects, allowing attackers to disclose protected information.

The vulnerability of the PI Studio XML analysis tool arises from an incorrect limitation on XML references to external objects. Operating this tool may allow a malicious actor to disclose protected information...

Microsoft SQL Server Management Studio Information Disclosure Vulnerability

Microsoft SQL Server Management Studio is an integrated environment for managing multiple SQL infrastructures from Microsoft. The product is mainly used for setting up, monitoring and managing SQL programs. An information disclosure vulnerability exists in Microsoft SQL Server Management Studio...

VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) SAML Authentication Bypass Vulnerability

VMware Workspace ONE Unified Endpoint Management Console is a console product from VMware. A SAML authentication bypass vulnerability exists in the VMware Workspace ONE Unified Endpoint Management Console AirWatch Console, which could allow an attacker to emulate an authorized SAML session if...

CVE-2018-1588

IBM Jazz Foundation IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

chromium-browser: Integer overflow in Skia

Integer overflows in Skia in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

chromium-browser: User confirmation bypass in external protocol handling

The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page...

Debian DLA-1499-1 : discount security update

Several heap-based buffer over-reads were found in discount, an implementation of the Markdown markup language in C, that allowed remote attackers to cause a denial of service via specially crafted files. For Debian 8 'Jessie', these problems have been fixed in version 2.1.7-1+deb8u1. We recommen...

CVE-2018-16252

FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection...

UBUNTU-CVE-2017-15420

Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

DEBIAN-CVE-2018-1000652

JabRef version =4.3.1 contains a XML External Entity XXE vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBib file. This...

ALPINE-CVE-2018-14567

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251...

chromium-browser: Same origin policy bypass in ServiceWorker

Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

ALPINE-CVE-2017-2640

An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process...

F5 BIG-IP Denial of Service Vulnerability (CNVD-2018-21232)

F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in the F5 BIG-IP. A remote attacker can exploit this vulnerability to cause a denial of service wh...

Fortify Software Security Center (SSC) XXE Vulnerability

Micro Focus Fortify Software Security Center SSC is a software security management platform from Micro Focus UK. A XXE vulnerability exists in Fortify Software Security Center SSC that could allow a remote, unauthenticated user to read arbitrary files or conduct server-side request forgery SSRF...