The vulnerability of the libexpat XML file analysis library lies in the improper restriction on recursive references to objects in DTDs, which allows attackers to trigger a service failure.

The vulnerability of the libexpat library for analyzing XML files is related to improper restrictions on recursive references to objects in DTDs. Exploiting this vulnerability could allow an attacker to cause a service failure...

RHEL 5 : spamassassin (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - spamassassin: Local user code injection in the meta rule syntax CVE-2018-11781 - A denial of service...

Moodle Security Breach

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from the failure to sanitize hypertext markup language in site logs...

DEBIAN-CVE-2024-5498

Use after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2024-36383

An issue was discovered in Logpoint SAML Authentication before 6.0.3. An attacker can place a crafted filename in the state field of a SAML SSO-URL response, and the file corresponding to this filename will ultimately be deleted. This can lead to a SAML Authentication login outage...

Logpoint 安全漏洞

Logpoint is a network security application from Logpoint Denmark. A security vulnerability exists in Logpoint SAML Authentication prior to version 6.0.3, which stems from a faulty authentication and may result in an interrupted authentication login...

Mattermost 安全漏洞

Mattermost Server is the United States Mattermost company's set of open source messaging platform. Mattermost Server suffers from an Access Control Error vulnerability that can be exploited by an attacker to switch their authentication mail from SAML to email and potentially edit personal details...

OESA-2024-1641 libxml2 security update

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

PT-2024-40127 · Packagist · Silverstripe Cms

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A cross-site scripting issue has been found in the CMS page history tab. This can be exploited if a user with CMS access posts malicious or unescaped HTML into any text fields on a...

CVE-2024-25724

In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers to execute code with the affected service's privileges, compromise the service's integrity, leak...

PT-2024-25296 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS versions 7.0.0 through 7.29 ILIAS versions 8.0.0 through 8.10 Description: A Stored Cross-site Scripting XSS issue in the "Import of user role and title of user role" feature allows remote authenticated attackers with administrative...

ILIAS 安全漏洞

ILIAS is an open source learning management system. A security vulnerability exists in ILIAS versions 7.20 through 7.30, 8.4 through 8.10, and 9.0, which stems from a stored cross-site scripting XSS vulnerability that allows remote, authenticated attackers to inject arbitrary web script or HTML...

PT-2024-5050 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.13.0 GitHub Enterprise Server version 3.9.15 GitHub Enterprise Server version 3.10.12 GitHub Enterprise Server version 3.11.10 GitHub Enterprise Server version 3.12.4 Description: An authentication...

CVE-2024-34085

A vulnerability has been identified in JT2Go All versions V2312.0001, Teamcenter Visualization V14.1 All versions V14.1.0.13, Teamcenter Visualization V14.2 All versions V14.2.0.10, Teamcenter Visualization V14.3 All versions V14.3.0.7, Teamcenter Visualization V2312 All versions V2312.0001. The...

DEBIAN-CVE-2024-4671

Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

PT-2024-25812 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions 13.0.0 through 13.1.0 Description: The history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML marku...

CycloneDX JavaScript Library 代码问题漏洞

The CycloneDX JavaScript Library is a core feature of the CycloneDX SBOM Standard open source OWASP CycloneDX for JavaScript written in TypeScript. A code issue vulnerability exists in CycloneDX JavaScript Library versions prior to 6.7.1 that stems from XML external entity injection when running...

PT-2024-3649 · Siemens · Jt2Go +1

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to V2312.0001 Teamcenter Visualization V14.1 versions prior to V14.1.0.13 Teamcenter Visualization V14.2 versions prior to V14.2.0.10 Teamcenter Visualization V14.3 versions prior to V14.3.0.7 Teamcenter Visualization V23...

CVE-2024-3628

The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

The vulnerability of the “Bookmarks” control element in Google Chrome and Microsoft Edge allows a hacker to execute arbitrary code.

The vulnerability of the “Bookmarks” control element in Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created HTML page...