Input validation

In OASIS Digital Signature Services DSS 1.0, an attacker can control the validation outcome i.e., trigger either a valid or invalid outcome for a valid or invalid signature via a crafted XML signature, when the InlineXML option is used. This defeats the expectation of non-repudiation...

PT-2020-13334 · Oasis · Oasis Digital Signature Services

Name of the Vulnerable Software and Affected Versions: OASIS Digital Signature Services DSS version 1.0 Description: The issue allows an attacker to control the validation outcome of a signature via a crafted XML signature when the InlineXML option is used, defeating the expectation of...

The vulnerability in the implementation of the XML::Twig Perl module for processing XML documents in a tree-like mode allows a attacker to cause a service failure or gain unauthorized access to protected information.

The vulnerability of the expandexternalents configuration implementation in the Perl module for processing XML documents in a tree-like mode, implemented via XML::Twig, is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow an attack...

dotnet: XML source markup processing remote code execution

It was discovered that .NET Core did not properly check the source markup of XML files. A remote, unauthenticated attacker could possibly exploit this flaw to execute arbitrary code by sending specially crafted requests to an application parsing certain kinds of XML files or an ASP.NET Core...

dotnet: XML source markup processing remote code execution

It was discovered that .NET Core did not properly check the source markup of XML files. A remote, unauthenticated attacker could possibly exploit this flaw to execute arbitrary code by sending specially crafted requests to an application parsing certain kinds of XML files or an ASP.NET Core...

CVE-2020-3405

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

CVE-2020-3405

Cisco SD-WAN vManage Software is affected by CVE-2020-3405 due to improper handling of XML External Entity (XXE) entries during parsing of XML files in the web UI. The issue enables an authenticated, remote attacker to read and write files stored by the application by persuading a user to import ...

CVE-2020-3405 Cisco SD-WAN vManage Software XML External Entity Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

EulerOS 2.0 SP2 : libxslt (EulerOS-SA-2020-1659)

According to the version of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafte...

EulerOS 2.0 SP2 : xulrunner (EulerOS-SA-2020-1619)

According to the versions of the xulrunner package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Expat, when used in a parser that has not called XMLSetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to...

Huawei Data Communication: Memory Leak Vulnerability in Several Huawei Products (huawei-sa-20171213-04-xml)

There is a memory leak vulnerability in several Huawei products. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Denial Of Service (DoS)

libxml2 is vulnerable to denial of service DoS. The vulnerability exists when used in recover mode, allows remote attackers to cause a denial of service NULL pointer dereference via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option whic...

CVE-2020-3310

A vulnerability in the XML parser code of Cisco Firepower Device Manager On-Box software could allow an authenticated, remote attacker to cause an affected system to become unstable or reload. The vulnerability is due to insufficient hardening of the XML parser configuration. An attacker could...

Design/Logic Flaw

A vulnerability in the XML parser code of Cisco Firepower Device Manager On-Box software could allow an authenticated, remote attacker to cause an affected system to become unstable or reload. The vulnerability is due to insufficient hardening of the XML parser configuration. An attacker could...

EulerOS Virtualization for ARM 64 3.0.2.0 : libxslt (EulerOS-SA-2020-1554)

According to the version of the libxslt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit...

libxml2: infinite loop in xz_decomp function in xzlib.c

The xzdecomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035...

Huawei EulerOS: Security Advisory for libxslt (EulerOS-SA-2020-1409)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.2.2 : expat (EulerOS-SA-2020-1445)

According to the versions of the expat packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an...

python: Missing salt initialization in _elementtree.c module

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming...

libxml2: DoS caused by incorrect error detection during XZ decompression

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash...