55195 matches found
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...
CVE-2026-77658
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload reads the number of bus handles from the file attribute "bushandles" using attributenumdata without validating an upper...
Moderate: Red Hat Security Advisory: assertj-core security update
An update for assertj-core is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...
[SECURITY] Fedora 43 Update: apr-util-1.6.5-1.fc43
The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more...
Linux Distros Unpatched Vulnerability : CVE-2026-80185
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser...
Linux Distros Unpatched Vulnerability : CVE-2026-79772
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of...
Linux Distros Unpatched Vulnerability : CVE-2026-77658
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: obs-server (UTSA-2026-093681)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093681 advisory. A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: apache-poi (UTSA-2026-093250)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093250 advisory. In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker...
NULL Pointer Dereference
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to NULL Pointer Dereference via the XML parsing process. An attacker can cause denial of service or memory corruption by submitting specially crafted XML input that triggers entity...
Out-of-Bounds
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-Bounds through the processing of crafted XML documents in the xmlSchemaValidateStream or xmlEncodeEntitiesInternal functions. An attacker can cause denial of service,...
Out-of-Bounds
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-Bounds via the buffer handling process in the packaged libxml2 component. An attacker can cause out-of-bounds memory writes by submitting specially crafted multi-gigabyte...
Use After Free
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Use After Free in the processing of XML documents with untrusted XSL stylesheets or when parsing untrusted documents with specific parse options enabled. An attacker can cause...
NULL Pointer Dereference
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to NULL Pointer Dereference via the XML Schema processing in the packaged libxml2 library. An attacker can cause a segmentation fault and disrupt service by supplying a crafted or...
Out-of-bounds Write
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-bounds Write via the processing of DTD validation errors with long QName prefixes and during validation against untrusted XML Schemas. An attacker can execute arbitrary co...
Out-of-bounds Read
Amendment This was deemed not a vulnerability. Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-bounds Read via the xmlSchemaIDCFillNodeTables function. An attacker can cause a denial of service by submitting specially...
UBUNTU-CVE-2026-79772
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid...
CVE-2026-79772
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid...