[SECURITY] Fedora 33 Update: python-lxml-4.5.1-4.fc33

lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries. It provides safe and convenient access to these libraries using the ElementTre e It extends the ElementTree API significantly to offer support for XPath, Relax NG, XML Schema, XSLT, C14N and much more.To contact the project...

Umbraco CMS 7.12.4 - Remote Code Execution (Authenticated)

Exploit Title: Umbraco CMS 7.12.4 - Remote Code Execution Authenticated Date: 2020-03-28 Exploit Author: Alexandre ZANNI noraj Based on: https://www.exploit-db.com/exploits/46153 Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12.4...

[SECURITY] Fedora 33 Update: python-lxml-4.5.1-3.fc33

lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries. It provides safe and convenient access to these libraries using the ElementTre e It extends the ElementTree API significantly to offer support for XPath, Relax NG, XML Schema, XSLT, C14N and much more.To contact the project...

The vulnerability of the txExecutionState function in browsers Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to trigger a service failure.

The vulnerability of the txExecutionState function in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to the use of memory after document processing using the XSLT Extensible Stylesheet Language Transformations language. Exploiting this vulnerability can allow a malicio...

yWorks yEd Code Execution Vulnerability

yWorks yEd is a graphical editor desktop application. A code execution vulnerability exists in yWorks yEd versions prior to 3.20.1. The vulnerability can be exploited for code execution via XSL transformations when using XML files in conjunction with custom stylesheets...

XXE in Apache Standard Taglibs

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity XXE attacks via a crafted XSLT extension in a 1 or 2 JSTL XML tag...

GitHub Security Lab: CodeQL query to detect XSLT injections

This bug was reported directly to GitHub Security Lab...

CVE-2017-5438

A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Umbraco CMS 7.12.4 Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Umbraco CMS - Authenticated Remote Code Execution Exploit Author: Alexandre ZANNI noraj Based on: https://www.exploit-db.com/exploits/46153 Vendor Homepage: http://www.umbraco.com/ Software Link:...

The vulnerability of the OpenOffice office suite arises from incorrect restrictions on path names to restricted directories. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the OpenOffice office suite is related to a recompilation error through “.. two dots” in files where the XSLT JAR filter is active. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

CVE-2020-2001

An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to PAN-OS management interface to write attacker supplied file on the system and elevate privileges. This issue affects: All...

CVE-2020-2001

An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to PAN-OS management interface to write attacker supplied file on the system and elevate privileges. This issue affects: All...

Path traversal

An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to PAN-OS management interface to write attacker supplied file on the system and elevate privileges. This issue affects: All...

CVE-2020-2001

CVE-2020-2001 affects Palo Alto Networks PAN-OS Panorama XSLT processing logic, where an external control of path and data allows an unauthenticated user with network access to PAN-OS management to write attacker-supplied files and escalate privileges. Affected versions include PAN-OS Panorama: a...

MS16-019: Description of the security update for the .NET Framework 4.5.2 in Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2: February 9, 2016

MS16-019: Description of the security update for the .NET Framework 4.5.2 in Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2: February 9, 2016 View products that this article applies to. Summary This update resolves a vulnerability in the Microsoft .NET Framework. The vulnerability could...

MS16-019: Description of the security update for the .NET Framework 4.5.2 in Windows Server 2012: February 9, 2016

MS16-019: Description of the security update for the .NET Framework 4.5.2 in Windows Server 2012: February 9, 2016 View products that this article applies to. Summary This update resolves a vulnerability in the Microsoft .NET Framework. The vulnerability could allow denial of service if an attack...

MS16-019: Description of the security update for the .NET Framework 3.5.1 in Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: February 9, 2016

MS16-019: Description of the security update for the .NET Framework 3.5.1 in Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: February 9, 2016 View products that this article applies to. Summary This update resolves a vulnerability in the Microsoft .NET Framework. The...

MS16-019: Description of the security update for the .NET Framework 4.6 and 4.6.1 in Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2: February 9, 2016

MS16-019: Description of the security update for the .NET Framework 4.6 and 4.6.1 in Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2: February 9, 2016 View products that this article applies to. Summary This update resolves a vulnerability in the Microsoft .NET Framework. The vulnerabilit...

MS16-019: Description of the security update for the .NET Framework 3.5 in Windows Server 2012: February 9, 2016

MS16-019: Description of the security update for the .NET Framework 3.5 in Windows Server 2012: February 9, 2016 View products that this article applies to. Summary This update resolves a vulnerability in the Microsoft .NET Framework. The vulnerability could allow denial of service if an attacker...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. The vulnerability exists as a flaw was found in the way Firefox parsed certain Scalable Vector Graphics SVG image files that contained eXtensible Style Sheet language Transformations XSLT. A web page containing a malicious SVG image file could...