3842 matches found
pki-core: access to external entities when parsing XML can lead to XXE
A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...
CVE-2023-27775
A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload...
SAP Application Interface Framework 跨站脚本漏洞
SAP Application Interface Framework SAP AIF is a German SAP SAP company's application program interface framework. A security vulnerability exists in the SAP Application Interface Framework that stems from the application allowing the use of HTML markup, which can be exploited by an attacker to...
PT-2023-20383 · Unknown · National Land Numerical Information Data Conversion Tool
Name of the Vulnerable Software and Affected Versions: National land numerical information data conversion tool all versions Description: The issue is related to the improper restriction of XML external entity references XXE in the National land numerical information data conversion tool. This...
xxl-job 跨站脚本漏洞
XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xue Li XXL-JOB community. A security vulnerability exists in xxl-job, which originates from the successful execution of loads uploaded via HTML in /xxl-job-admin/user/add and /xxl-job-admin/user/update...
CVE-2023-20030
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery SSRF attack through an affected device, or negatively impact the responsiveness of the...
National land numerical information data conversion tool 代码问题漏洞
National Land Information Division National land numerical information data conversion tool is a data conversion tool from National Land Information Division, Japan. A security vulnerability exists in the National land numerical information data conversion tool due to an improper restriction on X...
Hitachi Vantara Pentaho Business Analytics Server 代码问题漏洞
Hitachi Vantara Pentaho Business Analytics Server is a modern data blending, integration, and business analytics platform from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi Vantara Pentaho Business Analytics Server that stems from improper references to XML external...
The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in errors in XML request processing, which allow attackers to gain unauthorized access to protected information.
The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to errors in processing XML requests. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
CVE-2022-43473
A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability...
CVE-2022-1274
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users...
GHSA-8648-H559-8H42 Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting
All versions of Fluid Components before 3.5.0 were susceptible to Cross-Site Scripting. Version 3.5.0 of the extension fixes this issue. Due to the nature of the problem, some changes in your project's Fluid templates might be necessary to prevent unwanted double-escaping of HTML markup...
Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting
All versions of Fluid Components before 3.5.0 were susceptible to Cross-Site Scripting. Version 3.5.0 of the extension fixes this issue. Due to the nature of the problem, some changes in your project's Fluid templates might be necessary to prevent unwanted double-escaping of HTML markup...
The vulnerability of the Metrics component in the Google Chrome browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Metrics component in Google Chrome browser relates to the issue of operations going beyond the buffer in memory when processing HTML content. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected...
The vulnerability of the Mozilla Firefox browser, related to the execution of operations beyond the buffer in memory, allows an attacker to execute arbitrary code.
The vulnerability of the Mozilla Firefox browser is related to the execution of operations beyond the buffer boundaries in memory when processing HTML content. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Flickr: High resource consumption by insufficient sanitization of forum threads pagination
The forum threads pagination functionality was insufficiently sanitized, leading to high resource consumption. When a page number was provided in the URL that exceeded the number of available pages, an infinite loop was triggered, generating excessive markup on each iteration. The issue was...
ComponentSpace SAML 信任管理问题漏洞
ComponentSpace SAML is ComponentSpace's SAML and OpenID solution for ASP.NET and ASP.NET Core. A trust management issue vulnerability exists in ComponentSpace SAML version 4.4.0, which stems from a lack of SSL certificate validation...
Independentsoft JSpreadsheet 代码问题漏洞
Independentsoft JSpreadsheet is a Microsoft Excel-compatible API for Java and Android from Independentsoft, Germany. A security vulnerability exists in Independentsoft JSpreadsheet versions prior to 1.1.110, which stems from the API's susceptibility to XML External Entity XXE injection via a remo...
Jenkins Plugins Crap4J 代码问题漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...