The vulnerability of the Cisco IOS operating system allows a hacker to inject any desired Web or HTML code.

The vulnerability of the Cisco IOS operating system allows a hacker to inject any desired Web or HTML code...

Libxml2 memory corruption vulnerability in multiple Apple products (CNVD-2016-08340)

Apple iOS, OS X, tvOS, and watchOS are all products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Apple OS X is a specialized operating system developed for Mac computers; tvOS is a smart TV operating system; and watchOS is a smart watch operating system. Libxml2 is...

IBM Rational Quality Manager and Collaborative Lifecycle Management Command Injection Vulnerability

IBM Rational Quality Manager RQM and Collaborative Lifecycle Management CLM are both products of IBM Corporation. The former is a set of collaborative, Web-based quality management solutions, the latter is a set of collaborative lifecycle management solutions. A command injection vulnerability...

Polycom HDX Video End Points XML External Entity Denial of Service Vulnerability

Polycom HDX Video End Points video conferencing system. A denial of service vulnerability exists in Polycom HDX Video End Points. An attacker could exploit this vulnerability to cause a denial of service condition...

jenkins: Remote code execution through remote API (SECURITY-247)

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

The vulnerability of the Microsoft .NET Framework software platform, which allows a hacker to read arbitrary files

The vulnerability of the Microsoft .NET Framework software platform is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to read arbitrary files using XML data, which contains a declaration of an external object along with a reference to an...

Framework: denial-of-service attack with XML input

A denial of service flaw was found in the way Spring processes inline DTD declarations. A remote attacker could submit a specially crafted XML file that would cause out-of-memory errors when parsed...

spacewalk-java: Multiple XSS flaws

A stored cross-site scripting XSS flaw was found in the way spacewalk-java displayed group names. An attacker can embed HTML and Javascript in the values for group names in Satellite, allowing them to inject malicious content into the web page that is then displayed when viewing the snapshot data...

Mini-XML Remote Denial of Service Vulnerability

Mini-XML is a small XML parser developed using the C language . Mini-XML suffers from a denial-of-service vulnerability that could be exploited by remote attackers to submit a special request for a denial-of-service attack...

SimplE RePort wrIting and COllaboration tool: Serpico

Serpico is at its core a report generation tool but targeted at creating information security reports. When building a report the user adds “findings” from the template database to the report. When there are enough findings, click ‘Generate Report’ to create the docx with your findings. The docx...

CVE-2016-3039

IBM Traveler 8.x and 9.x before 9.0.1.12 allows remote authenticated users to read arbitrary files or cause a denial of service memory consumption via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

The vulnerability of the SPSS Statistics data analysis system allows a perpetrator to execute arbitrary codes on 32-bit platforms.

The vulnerability of the ActiveX component of SPSS Statistics is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on 32-bit platforms using a specially crafted HTML document...

The vulnerability of the SAP NetWeaver Application Server allows a perpetrator to compromise the security of information.

The vulnerability of SAP NetWeaver Application Server is related to errors in the processing of XML requests. Exploiting this vulnerability allows a malicious actor to compromise information security by sending specially crafted TCP and XML requests remotely...

The vulnerability of Microsoft XML Core Services allows a malicious attacker to compromise the confidentiality of protected information.

The vulnerability in Microsoft Windows, related to the processing of XML content, allows attackers to gain access to confidential information...

The vulnerability of the automated system for managing technological processes, KingSCADA, allows a remote attacker to perform a maintenance failure, provided that the user opens a specially crafted XML document.

The vulnerability of the automated system for managing technological processes, KingSCADA, is related to the unsafe processing of external XML entities. Exploiting this vulnerability allows a malicious attacker to perform a service failure, provided that the user opens a specially crafted XML...

ALPINE-CVE-2016-4472

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and...

DEBIAN-CVE-2016-4472

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and...

CA Release Automation Denial of Service Vulnerability

CA Release Automation formerly CA LISA Release Automation is a suite of enterprise-class release automation solutions from CA USA. The solution enables continuous delivery across the application lifecycle and can streamline and execute application releases, centralize application operations from...

python-docx XML External Entity Vulnerability

python-docx is a python library for editing and generating Microsoft Word documents. An XML external entity vulnerability exists in python-docx version 0.8.5. An attacker can exploit this vulnerability to conduct an XML external entity attack...

Six Apart Movable Type Pro and Advanced SQL Injection Vulnerabilities

Six Apart Movable Type MT is a blogging system from Six Apart Inc. in the U.S. Pro and Advanced are the professional and advanced versions of the system, respectively. A SQL injection vulnerability exists in Six Apart MT Pro and Advanced. The vulnerability can be exploited to execute arbitrary SQ...