rubygem-will_paginate: XSS vulnerabilities

It was found that ruby willpaginate is vulnerable to a XSS via malformed input that cause pagination to occur on an improper boundary. This could allow an attacker with the ability to pass data to the willpaginate gem to display arbitrary HTML including scripting code within the web interface...

The vulnerability of the YWorksLayouter component of the SAP NetWeaver software integration platform allows a perpetrator to access confidential information or cause service failures.

The vulnerability of the YWorksLayouter component of the SAP NetWeaver software integration platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information or cause service...

The vulnerability of the hidden content checking component in the SAP NetWeaver software integration platform allows a perpetrator to access confidential information or cause service failures.

The vulnerability of the hidden content checking component in the SAP NetWeaver software integration platform is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information or caus...

CVE-2017-17291

Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20,...

CVE-2017-15346

XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S6700 V200R001C00, V200R002C00, V200R003C00, V200R005C00,...

Cross site request forgery (csrf)

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be us...

CVE-2018-1000053

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be us...

CVE-2018-5789

An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is a Remote, Unauthenticated XML Entity Expansion Denial of Service on the WiNG Access Point / Controller via crafted XML entities to the Web User Interface...

Micro Focus Fortify Audit Workbench and Fortify Software Security Center XML External Entity Injection Vulnerability

Micro Focus Fortify Audit Workbench AWB and Micro Focus Fortify Software Security Center SSC are both products of Micro Focus, a British company. Micro Focus Fortify Audit Workbench AWB is a software security auditing platform and Micro Focus Fortify Software Security Center SSC is a software...

The vulnerability of the Xerces2 Java XML parser, related to resource management errors, allows attackers to cause service failures.

The vulnerability of the Xerces2 Java XML parser is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause a service failure increased computational resources usage by using a specially crafted XML message...

PT-2018-1004 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions prior to the fixed version Description: A vulnerability in the Secure Sockets Layer SSL VPN functionality could allow an unauthenticated, remote attacker to cause a reload of the affecte...

CloudBees Jenkins FindBugs plugin XML external entity injection vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . FindBugs Plugin is used in one of th...

ALPINE-CVE-2018-5336

In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth...

The vulnerability of Google Chrome’s Blink rendering module allows a hacker to read data beyond the memory limit of the application.

The vulnerability of Google Chrome’s Blink engine is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to read data beyond the application’s memory boundary using a specially crafted HTML page...

The vulnerability in the JavaScript V8 engine of Google Chrome’s browser allows a hacker to execute arbitrary code in an isolated environment.

The vulnerability of Google Chrome’s JavaScript V8 engine is related to a type conversion error. Exploiting this vulnerability allows an attacker to execute arbitrary code in a isolated environment using a specially crafted HTML page...

The vulnerability of Google Chrome’s Skia graphics library allows a hacker to perform memory-reading operations beyond the limits of the application’s memory.

The vulnerability of Google Chrome’s Skia graphics library exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to perform memory-walking attacks using a specially crafted HTML page...

CVE-2017-17792

BlogoText (CMS) contains a Cross-site scripting (XSS) flaw in the markup_clean_href function, inc/conv.php, up to version 3.7.6. The root cause is improper handling in markup_clean_href that allows remote attackers to inject arbitrary JavaScript via a comment, as described in multiple sources (NV...

Huawei DP300 XML Parser Denial of Service Vulnerability

Huawei DP300 is a video conferencing endpoint from Huawei, a Chinese company. A denial of service vulnerability exists in the Huawei DP300 XML parser due to the product's failure to adequately checksum the malloc call to request memory. An authenticated, local attacker could launch a denial of...

Memory leak vulnerability in multiple Huawei products (CNVD-2017-37503)

Huawei AR and SRG series enterprise routers are all-in-one routers for small and medium-sized offices or branches of small and medium-sized enterprises launched by Huawei; TE series, DP300, and MAX PRESENCE are all integrated desktop smart products and high-definition videoconferencing terminals...

The vulnerability of Google Chrome browsers, related to the use of memory after it is freed, allows a hacker to perform reading beyond the buffer limit.

The vulnerability of Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to perform reading beyond the buffer limit using a specially crafted HTML page...