Design/Logic Flaw

An issue was discovered in the 3CX Phone system web management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XXE via a crafted XML document in POST data. There is potential to use this for SSRF reading local files, outbound HTTP, and outbound DNS...

Use-After-Free

libxml2 is vulnerable to use-after-free vulnerability. This occurs in the xmlSAX2AttributeNs function in libxml2 which allows remote attackers to cause a denial of service via a crafted XML document that may lead to an application crash...

The vulnerability of the QXMLStreamReader function in the QXmlStream component of the cross-platform software development framework for Qt allows a perpetrator to cause a system failure or gain unauthorized access to information.

The vulnerability of the QXMLStreamReader function in the QXmlStream component of the cross-platform software development framework for Qt is related to double memory deallocation. Exploiting this vulnerability can allow an attacker to cause service failures or gain unauthorized access to...

XML Entity Expansion (XEE)

ruby is vulnerable to XML Entity Expansion XEE attacks. The vulnerability exists as the REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service memory consumption via a crafted XML document, aka an XML Enti...

XML External Entity (XXE)

c3p0 is vulnerable to XML external entity XXE attacks. The external entity expansion is not disabled in the XML parser, which would allow a remote attacker to perform XXE attacks via a crafted XML document. This CVE is also known as CVE-2019-5427...

CVE-2018-1000840

Processing Foundation Processing version 3.4 and earlier contains a XML External Entity XXE vulnerability in loadXML function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use...

CVE-2018-1000840

Processing Foundation Processing version 3.4 and earlier contains a XML External Entity XXE vulnerability in loadXML function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use...

CVE-2018-1000840

Processing Foundation Processing version 3.4 and earlier contains a XML External Entity XXE vulnerability in loadXML function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use...

CVE-2016-9596

libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service stack consumption via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627...

Design/Logic Flaw

libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service stack consumption via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627...

CVE-2016-9598

libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service out-of-bounds read and application crash via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483...

XML External Entities (XXE)

libxml2 is vulnerable to XML external entity attacks. The xmlParserHandlePEReference function in parser.c allows external parameter entities to be loaded regardless of whether entity substitution or validation is enabled. This allows an attacker to cause a denial of service condition or an...

CVE-2015-3450

Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service memory corruption or execute arbitrary code via a crafted XML document...

Heap overflow

Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service memory corruption or execute arbitrary code via a crafted XML document...

CVE-2015-3450

CVE-2015-3450 concerns a heap-based buffer overflow in libaxl 0.6.9. A crafted XML document can cause memory corruption, leading to denial of service or arbitrary code execution. The vulnerability is tied to libaxl’s XML handling; no specific vulnerable products or versions beyond 0.6.9 are state...

Xxe

XML External Entity XXE vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a crafted XML document...

CVE-2010-2245

XML External Entity XXE vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a crafted XML document...

Design/Logic Flaw

The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document...

CVE-2015-2253

The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document...

CVE-2017-5969

libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service NULL pointer dereference via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML...