Fedora: Security Advisory for jaxen (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: xmlunit-2.9.0-11.fc40

XMLUnit provides you with the tools to verify the XML you emit is the one you want to create. It provides helpers to validate against an XML Schema, assert the values of XPath queries or compare XML documents against expected outcome s...

[SECURITY] Fedora 40 Update: jaxen-1.2.0-17.fc40

Jaxen is an open source XPath library written in Java. It is adaptable to many different object models, including DOM, XOM, dom4j, and JDOM. Is it also possible to write adapters that treat non-XML trees such as compil ed Java byte code or Java beans as XML, thus enabling you to query these trees...

[SECURITY] Fedora 40 Update: apache-commons-jxpath-1.3-52.fc40

Defines a simple interpreter of an expression language called XPath. JXPath applies XPath expressions to graphs of objects of all kinds: JavaBeans, Maps, Servlet contexts, DOM etc, including mixtures thereof...

openSUSE: Security Advisory for modsecurity (openSUSE-SU-2023:0257-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JXPath Heap Buffer Overflow DoS

The vulnerability of the JXPath object processing library is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

January 9, 2024—KB5034129 (OS Build 20348.2227)

None None...

CVE-2023-46214: XML Injection (aka Blind XPath Injection)

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations XSLT that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance...

Amazon Linux 2 : apache-ivy (ALAS-2023-2302)

The version of apache-ivy installed on the remote host is prior to 2.3.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2302 advisory. Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software...

CVE-2023-36429: Improper Neutralization of Data within XPath Expressions

Microsoft Dynamics 365 On-Premises Information Disclosure Vulnerability...

CVE-2023-36433: Improper Neutralization of Data within XPath Expressions

Microsoft Dynamics 365 On-Premises Information Disclosure Vulnerability...

libxml2:xpath: Heap-buffer-overflow in xmlCopyCharMultiByte

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=5952232040038400 Project: libxml2 Fuzzing Engine: afl Fuzz Target: xpath Job Type: aflasanlibxml2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x6020000001b4 Crash...

libxslt:xpath: Memcpy-param-overlap in xmlDictAddString

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed Report: https://oss-fuzz.com/testcase?key=6379439417851904 Project: libxslt Fuzzing Engine: honggfuzz Fuzz Target: xpath Job Type: honggfuzzasanlibxslt Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address:...

libxslt:xpath: Crash in xmlDictLookupInternal

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed Report: https://oss-fuzz.com/testcase?key=6658902189801472 Project: libxslt Fuzzing Engine: afl Fuzz Target: xpath Job Type: aflasanlibxslt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0001a65fd436 Crash State:...

CVE-2023-43187: XML Injection (aka Blind XPath Injection)

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests...

CVE-2022-4245: XML Injection (aka Blind XPath Injection)

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtilwriteComment fails to sanitize comments for a -- sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection...

CVE-2019-19450: XML Injection (aka Blind XPath Injection)

paraparser in ReportLab before 3.5.31 allows remote code execution because startunichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '...

LG Simple Editor Remote Code Execution Exploit

This Metasploit module exploits broken access control and directory traversal vulnerabilities in LG Simple Editor software for gaining code execution. The vulnerabilities exist in versions of LG Simple Editor prior to v3.21. By exploiting this flaw, an attacker can upload and execute a malicious...

Oracle Linux 6 : libxml2 (ELSA-2011-1749)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1749 advisory. - Fixes another XPath problem CVE-2011-2834 - Fix a potential crasher in XPath or XSLT, CVE-2011-1944 Tenable has extracted the preceding description...

primabazar.cz Cross Site Scripting vulnerability OBB-3638164

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...