Cross site scripting

Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCUFILEINIT field of a Save Configuration XML document. The payload is triggered in the HTTP error response pages...

Regular Expression Denial Of Service (ReDoS)

is-svg is vulnerable to regular expression denial of service. An attacker is able to crash the application via a malicious SVG/XML document due to the usage of an insecure regular expression...

XML External Entity (XXE)

xmlgraphics-commons is vulnerable to XML external entity attacks. The external DTDs are not disabled by default and allows an attacker submit requests on behalf of the server via a malicious XML document...

PT-2021-19204

Name of the Vulnerable Software and Affected Versions NCR Command Center Agent version 16.3 Description The CMCAgent component in NCR Command Center Agent version 16.3, used on Aloha POS/BOH servers, allows for the submission of a runCommand parameter within an XML document sent to port 8089. Thi...

VulnCheck KEV: CVE-2021-3122

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...

EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2020-2551)

According to the versions of the libreoffice packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not valida...

NewStart CGSL CORE 5.04 / MAIN 5.04 : qt Multiple Vulnerabilities (NS-SA-2020-0062)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has qt packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp. CVE-2018-19872 - An issue was...

Ubuntu: Security Advisory (USN-4619-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial of service

SAP NetWeaver Compare Systems versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service...

CVE-2020-6366: Improper Input Validation

SAP NetWeaver Compare Systems versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service...

CVE-2020-4774

An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information su...

PT-2020-18237

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 7.0.9 through 7.0.10 Description The issue is caused by the improper handling of user-supplied input, potentially allowing a remote attacker to obtain unauthorized access or reveal sensitive...

Security Bulletin: An XPath vulnerability may impact IBM Cúram Social Program Management (CVE-2020-4774)

Summary An XPath vulnerability may impact IBM Cúram Social Program Management, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information such as XML...

Debian DLA-2377-1 : qt4-x11 security update

Several vulnerabilities were fixed in qt4-x11, the legacy version of the Qt toolkit. CVE-2018-15518 Double-free or corruption in QXmlStreamReader during parsing of a specially crafted illegal XML document. CVE-2018-19869 A malformed SVG image causes a segmentation fault. CVE-2018-19870 A malforme...

Design/Logic Flaw

yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document...

CVE-2020-25215: Improper Restriction of XML External Entity Reference

yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document...

NEC ExpressCluster ApplyConfig XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster. Authentication is not required to exploit this vulnerability. The specific flaw exists within the clpwebmc executable. Due to the improper restriction of XML External Enti...

Huawei EulerOS: Security Advisory for qt (EulerOS-SA-2020-1881)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2020-0296 Updated xerces-c packages fix security vulnerability

A use-after-free vulnerability was found in xerces-c in the way an XML document is processed via the SAX API. Applications that process XML documents with an external Document Type Definition DTD may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially...

XML External Entity (XXE)

everrest-core is vulnerable to XML external entity XXE attacks. The external DTDs are not disabled by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server or read system files...