PT-2019-2120 · Cisco · Cisco Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance versions prior to the fixed version Cisco Firepower Threat Defense versions prior to the fixed version Description: The issue is related to improper credential management when using NT LAN Manager NTLM or bas...

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server and the Cisco Expressway software lies in the lack of proper input data validation. This allows a perpetrator to trigger a service failure.

The vulnerability of the Microprogramming Software of the Cisco TelePresence Video Communication Server and the Cisco Expressway software exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending SIP message...

CVE-2018-17169

An XML external entity XXE vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

The vulnerability of the Microsoft XML Core Services MSXML on the Windows operating system allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft XML Core Services MSXML in the Windows operating system is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created web page from a remote...

The vulnerability of Google Chrome, related to improper input data validation, allows a hacker to execute arbitrary code.

The vulnerability of Google Chrome is related to an incorrect optimization assumption in the V8 module. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in a isolated software environment, using a specially created HTML page...

CVE-2019-0792

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0793, CVE-2019-0795...

ArcSight Logger XML External Entity Parsing Vulnerability

Micro Focus ArcSight Logger is a suite of log management software from Micro Focus UK. The software collects and integrates data from any log generation source for log management, searching, indexing, reporting, analysis and retention. An XML external entity injection vulnerability exists in Micr...

The vulnerability relates to the implementation of Security Assertion Markup Language (SAML) for single-sign-on authentication in the integrated messaging system Cisco Unity Connection. This vulnerability allows attackers to perform cross-site scripting attacks.

The vulnerability of the Security Assertion Markup Language SAML authentication mechanism for Single Sign-On SSO in the integrated Cisco Unity Connection messaging system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor,...

The vulnerability of the WebRTC technology implementation in Google Chrome web browsers allows a hacker to induce a service failure.

The vulnerability of the WebRTC technology implementation in Google Chrome browser is related to insufficient verification of the pointer’s validity. Exploiting this vulnerability can allow a malicious actor to cause service failures through a specially created HTML page...

The vulnerability in the web interfaces of microprogramming software for network storage devices such as Seagate GoFlex Home, Medion LifeCloud NAS, and Netgear Stora allows a hacker to exploit their privileges.

The vulnerability of the web interfaces of microprogramming software for network storage devices such as Seagate GoFlex Home, Medion LifeCloud NAS, and Netgear Stora is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor to...

UBUNTU-CVE-2019-5760

Insufficient checks of pointer validity in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

The vulnerability of the `comps_objmrtree_unite` function in the libcomps library, which is related to memory usage after its deallocation, allows an attacker to execute arbitrary code.

The vulnerability of the compsobjmrtreeunite function in the libcomps library for working with XML files is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created XML file...

chromium-browser: Use after free in Blink

Incorrect object lifecycle management in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

The vulnerability of the XML Publisher component in the PeopleSoft Enterprise PeopleTools business application suite allows a malicious individual to gain unauthorized access to protected data.

The vulnerability of the XML Publisher component in the PeopleSoft Enterprise PeopleTools business application suite is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTP protocol...

The vulnerability of the web interface of the Cisco Secure Access Control System allows a perpetrator to access confidential information.

The vulnerability of the Cisco Secure Access Control System’s web interface is related to incorrect processing of external XML entities when working with XML files. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

The vulnerability of the S3 protocol in the S3 Browser allows a hacker to view files and obtain NTLMv2 user hash values.

The vulnerability of the S3 Browser protocol based on HTTP is related to shortcomings in the restrictions on XML links to external objects. In this case, server responses are transmitted in XML format. Exploiting this vulnerability allows a malicious actor to remotely access files and obtain user...

The vulnerability of the Cisco Secure ACS access control system’s web interface allows a perpetrator to gain access to confidential information.

The vulnerability in the Cisco Secure ACS access control system’s web interface is related to improper processing of external XML entities when working with XML files. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

The vulnerability of the IIoT Monitor monitoring platform lies in its improper control of external XML links, allowing attackers to inject incorrect documents into the output data.

The vulnerability of the IIoT Monitor platform is related to improper control of external XML links. Exploiting this vulnerability could allow a malicious actor to inject incorrect documents into the output data...

The vulnerability of the MediaRecorder component in the Google Chrome web browser, which allows a hacker to trigger a service failure

The vulnerability of the MediaRecorder component in the Google Chrome web browser arises from an operation that goes beyond the buffer limits in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially created HTML page...

CVE-2016-9651

A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...