1558 matches found
PRODSECBUG-2272: XPath Injection via front end rendering functionality
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
CVE-2019-4539: XML Injection (aka Blind XPath Injection)
IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. IBM X-Force ID: 165812...
libxslt:xpath: Heap-buffer-overflow in xsltFormatNumberConversion
Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed Report: https://oss-fuzz.com/testcase?key=5656808252768256 Project: libxslt Fuzzing Engine: afl Fuzz Target: xpath Job Type: aflasanlibxslt Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60300000131f Crash...
libxslt/xpath: Crash in xmlXPathCompileExpr
Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed report: https://oss-fuzz.com/testcase?key=5702070090334208 Project: libxslt Fuzzer: libFuzzerlibxsltxpath Fuzz target binary: xpath Job Type: libfuzzerubsanlibxslt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fccc6e37fd...
CVE-2019-14277: XML Injection (aka Blind XPath Injection)
Axway SecureTransport 5.x through 5.3 or 5.x through 5.5 with certain API configuration is vulnerable to unauthenticated blind XML injection and XXE in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks i.e., SSRF...
AZADMIN CMS Of HIDEA 1.0 SQL Injection
Sql Injection on AZADMIN CMS of HIDEA v1.0 + Date: 24/06/2019 + CWE Number : CWE-89 + Risk: High + Author: Felipe Andrian Peixoto + Vendor Homepage: https://www.hidea.com/ + Contact: [email protected] + Tested on: Windows 7 and Linux + Vulnerable Files: newsdet.php + Dork :...
EulerOS Virtualization for ARM 64 3.0.2.0 : libxml2 (EulerOS-SA-2019-1614)
According to the versions of the libxml2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There ...
CVE-2019-9892: XML Injection (aka Blind XPath Injection)
An issue was discovered in Open Ticket Request System OTRS 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of...
EulerOS Virtualization 3.0.1.0 : libxml2 (EulerOS-SA-2019-1559)
According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs...
Denial Of Service (DoS)
libxml2 is vulnerable to denial of service. Multiple flaws were found in the way libxml2 parsed certain XPath XML Path Language expressions. If an attacker were able to supply a specially-crafted XML file to an application using libxml2, as well as an XPath expression for that application to run...
Denial Of Service (DoS)
libxml2 is vulnerable to denial of service. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way libxml2 parsed certain XPath expressions. If an attacker were able to supply a specially-crafted XML file to an application using libxml2, as well as an XPath...
Denial Of Service (DoS)
libxml2 is vulnerable to denial of service. Remote attackers are able to crash the application due to a double free vulnerability related to XPath handling...
Out-Of-Bounds Read
libxslt is a library for transforming XML files into other textual formats including HTML, plain text, and other XML representations of the underlying data using the standard XSLT stylesheet transformation mechanism. A heap-based buffer overflow flaw was found in the way libxslt applied templates...
EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2019-1315)
According to the version of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A null pointer dereference vulnerability exists in the xpath function of libxml2 when parsing invalid XPath expression. Applications processing...
EulerOS 2.0 SP5 : libxml2 (EulerOS-SA-2019-1316)
According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A null pointer dereference vulnerability exists in the xpath function of libxml2 when parsing invalid XPath expression. Applications processing...
[SECURITY] Fedora 29 Update: libxmlb-0.1.8-2.fc29
XML is slow to parse and strings inside the document cannot be memory mappe d as they do not have a trailing NUL char. The libxmlb library takes XML source, and converts it to a structured binary representation with a deduplicated string table -- where the strings have the NULs included. This...
Versa Networks: Versa Director is susceptible to Command Injection attacks (e.g., SQL, LDAP, XML, Xpath)
In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data forms, cookies, HTTP headers etc. to a...
SUSE-SU-2019:13985-1 Security update for libxml2
This update for libxml2 fixes the following issues: Security issue fixed: - CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval function when parsing an invalid XPath expression in the XPATHOPAND or XPATHOPOR case leading to a denial of service attack bsc1102046 Other Issue...
CVE-2019-0268: XML Injection (aka Blind XPath Injection)
SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...