infinispan: deserialization of data in XML and JSON transcoders

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possibl...

Netis-WF2419 HTML Injection Vulnerability

Netis-WF2419 is a router product. The Netis-WF2419 suffers from an HTML injection vulnerability that stems from a program not properly validating user-supplied input. An attacker could use this vulnerability to run HTML and script code in the context of an affected website to steal cookie-based...

chromium-browser: Incorrect escaping of MathML in Blink

Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

CVE-2017-16164

desafio is a simple web server. desafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url, but is limited to accessing only .html files...

Google Chrome MathML Incorrect Escape Vulnerability

Google Chrome is a web browser developed by Google Inc. Blink is a browser layout engine rendering engine jointly developed by Google Inc. and Opera Software of Norway. A security vulnerability exists in Blink in versions of Google Chrome prior to 67.0.3396.62, which stems from the program's...

CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

USN-3661-1 batik vulnerability

It was discovered that Batik incorrectly handled certain XML. An attacker could possibly use this to expose sensitive information...

Drupal Automated Logout Module HTML Injection Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An HTML injection vulnerability exists in Drupal's Automated Logout module that stems from a failure to adequately validate user input. An attacker could exploit this...

Apache NiFi SplitXML processor code execution vulnerability

Apache NiFi is the United States Apache Apache Software Foundation of a set of data flow-based data processing and distribution system. The system supports the configuration and transformation of data routing indicator maps and system intermediary logic , etc. SplitXML processor is one of the XML...

Redhat Mobile Application Platform HTML Injection Vulnerability

RHMAP is a mapping statistics package. app Studio component is one of the app development components. A security vulnerability exists in the App Studio component in RHMAP version 4.4. An attacker can exploit the vulnerability to execute script code or HTML in the context of a browser...

Microsoft PowerPoint Remote Code Execution Vulnerability (CNVD-2018-10942)

Microsoft Office 2016 for Mac is a Mac-based office software suite product developed by Microsoft Corporation in the U.S. PowerPoint is a document presentation tool in the Office suite. A security vulnerability exists in PowerPoint in Microsoft Office 2016 for Mac-based platforms, which stems fro...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

CVE-2018-10832

ModbusPal 1.6b is vulnerable to an XML External Entity XXE attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will retu...

Pulse Secure Pulse Connect Secure Denial of Service Vulnerability

Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure, a US-based company. A security vulnerability exists in Pulse Connect Secure versions 8.1.x prior to 8.1R14, 8.2.x prior to 8.2R11, and 8.3.x prior to 8.3R5, which stems from the...

CVE-2018-9849

Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service memory consumption and memory errors via a crafted XML document...

VirtueMart Cross-Site Scripting Vulnerability

VirtueMart is an open source e-commerce solution compatible with Joomla! The solution supports 128-bit HTTPS encryption, support for different language switching and currency switching and other features. A cross-site scripting vulnerability exists in versions prior to VirtueMart 3.2.14. A remote...

CVE-2018-6660

Directory Traversal vulnerability in McAfee ePolicy Orchestrator ePO 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file...

CVE-2018-9031

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "ifpwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side...

textpattern denial of service vulnerability

textpattern is an excellent blogging system. A security vulnerability exists in the Import XML feature in textpattern version 4.6.2. An attacker can exploit this vulnerability by uploading a specially crafted XML file to cause a denial of service exhaustion of server memory resources...