The vulnerability of the Google Chrome browser’s Media component, caused by a numerical overflow, allows a malicious actor to trigger an overflow in the buffer through a specially created HTML page.

The vulnerability of the Google Chrome browser’s Media component is caused by a numerical overflow condition. Exploiting this vulnerability allows an attacker to trigger the overflow by using a specially created HTML page...

PT-2021-13362 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions 9 through 12 Description: The issue is related to improper input validation in the onCreate method of certain activities, allowing HTML tags to interfere with a consent dialog. This could lead to remote escalation of privileg...

CVE-2021-3836

dbeaver is vulnerable to Improper Restriction of XML External Entity Reference...

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats, related to improper code generation management, allows attackers to execute commands on the host.

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to improper handling of code generation. Exploiting this vulnerability allows an attacker to execute commands on the host by manipulating the processed input data...

CVE-2021-41030

An authentication bypass by capture-replay vulnerability CWE-294 in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated attacker to impersonate an existing user by intercepting and re-using valid SAML authentication messages...

CVE-2021-44556

National Library of the Netherlands digger 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity XXE vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS...

The vulnerability of the corporate application store server, Citrix StoreFront, allows attackers to perform XXE attacks.

The vulnerability of the corporate application store server Citrix StoreFront is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats allows attackers to download files of dangerous types indefinitely. This enables attackers to upload and execute arbitrary code from a remote host.

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability could allow an attacker to download and execute arbitrary code from a remote host by...

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats allows a hacker to cause a service failure due to uncontrolled resource consumption.

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to an uncontrolled resource consumption. Exploiting this vulnerability may allow a malicious actor to cause a service failure by consuming excessive resources on the central processor...

PT-2021-14732 · Jenkins · Jenkins Perforce Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Performance Plugin versions 3.20 and earlier Description: The issue is related to the XML parser not being configured to prevent XML external entity XXE attacks. This allows attackers who can control workspace contents to have Jenkins...

Eclipse Cyclone DDS 代码问题漏洞

Eclipse Cyclone DDS is a very high performance and robust open source DDS implementation from the Eclipse Foundation. A code issue vulnerability exists in Eclipse Cyclone DDS that stems from the product's failure to properly handle write-what-where logic. The vulnerability allows an attacker to...

sqlite: dropping of shadow tables not restricted in defensive mode

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page...

Microsoft SharePoint Remote Code Execution Vulnerability

Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account...

The vulnerability of Google Chrome’s browser loading function, related to memory usage after it is released, allows a hacker to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of Google Chrome’s web browser loading function is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions through a specially created...

Antenna House Office Server Document Converter 代码问题漏洞

Antenna House Office Server Document Converter Osdc is an office server document converter from Antenna House USA. It is used to batch convert Word, Excel and Powerpoint into high quality Pdf or image formats that are easy to share and look accurate on any screen. A code issue vulnerability exist...

CVE-2020-23050

TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code...

Google Chrome 资源管理错误漏洞

Chrome is a web browsing tool developed by Google. a post-release reuse vulnerability exists in Profiles in versions prior to Google Chrome 95.0.4638.54. A remote attacker exploited this vulnerability to potentially exploit heap corruption via a crafted HTML page...

Google Chrome 安全特征问题漏洞

Chrome is a web browsing tool developed by Google. versions prior to Google Chrome 95.0.4638.54 are vulnerable to an improper Blink implementation. An attacker could exploit this vulnerability to abuse content security policies via crafted HTML pages...

USN-5110-1 ardour vulnerability

It was discovered that Ardour incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

TinyXML 安全漏洞

TinyXML is a C++ XML parser that can be easily integrated into other programs. An infinite loop vulnerability exists in TiXmlParsingData::Stamp in tinyxmlparser.cpp in TinyXML 2.6.2 and earlier. An attacker can exploit this vulnerability to cause a denial of service via a specially crafted XML...