1101 matches found
CVE-2019-10266
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication...
CVE-2019-10266
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication...
PT-2019-11671
Name of the Vulnerable Software and Affected Versions Ahsay Cloud Backup Suite versions prior to 8.1.1.50 Description An issue allows reading the file structure and content of files without authentication by sending an out-of-bounds XML document to a URL. Recommendations For versions prior to...
SAP HANA Extended Application Services External Entity Injection Vulnerability
SAP HANA is a high-performance real-time data analytics platform from SAP. The platform provides data query functions to support users to query real-time business data query and analysis.Extended Application Services is an application server, Web server and SAP HANA System within the Web...
EulerOS 2.0 SP5 : libxml2 (EulerOS-SA-2019-1685)
According to the version of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause...
XML External Entities (XXE)
expat is vulnerable to denial of service. Entities expansions are not properly handled unless using the XMLSetEntityDeclHandler function. This allows remote attackers to crash the process, send HTTP requests on behalf of the server or read arbitrary files via a malicious XML document...
CVE-2019-12761
CVE-2019-12761 affects PyXDG prior to 0.26. A code injection issue arises via crafted Python in a Category element of a Menu XML (.menu) file, triggered when XDG_CONFIG_DIRS leads to xdg.Menu.parse. Root cause is lack of sanitization before an eval call in xdg/Menu.py. Various advisories (Debian,...
CVE-2019-12761: Improper Control of Generation of Code
A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDGCONFIGDIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in...
Out-Of-Bounds Read
PHP is vulnerable to out-of-bounds read attacks. This exists in the phpwddxpushelement function in ext/wddx/wddx.c which allows remote attackers to cause a denial of service or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document...
Use After Free
PHP is vulnerable to use after free vulnerability. The vulnerability exists in the wddxstackdestroy function in ext/wddx/wddx.c in PHP. Remote attackers could cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset...
Null Pointer Dereference
PHP is vulnerable to null pointer dereference vulnerability. This exists in ext/wddx/wddx.c which allows remote attackers to cause a denial of service via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string...
Use-After-Free
libxml2 is vulnerable to use-after-free vulnerability. This occurs in the xmlSAX2AttributeNs function in libxml2 which allows remote attackers to cause a denial of service via a crafted XML document that may lead to an application crash...
Xxe
The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked...
openSUSE Security Update : libreoffice (openSUSE-2019-642)
This update for libreoffice to 6.0.5.2 fixes the following issues : Security issues fixed : - CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by...
The vulnerability of the QXMLStreamReader function in the QXmlStream component of the cross-platform software development framework for Qt allows a perpetrator to cause a system failure or gain unauthorized access to information.
The vulnerability of the QXMLStreamReader function in the QXmlStream component of the cross-platform software development framework for Qt is related to double memory deallocation. Exploiting this vulnerability can allow an attacker to cause service failures or gain unauthorized access to...
MailEnable Cross-Site Scripting Vulnerability
MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site scripting vulnerability exists in the mail settings in MailEnable versions prior to 8.60. The vulnerability can be exploited by an attacker to read local files or scan the internal network by sending the...
Design/Logic Flaw
MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...
CVE-2015-9280
MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...
XML Entity Expansion (XEE)
ruby is vulnerable to XML Entity Expansion XEE attacks. The vulnerability exists as the REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service memory consumption via a crafted XML document, aka an XML Enti...