GHSA-6V7W-535J-RQ5M Pivotal Spring Framework DoS Attack with XML Input

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service memory consumption and out-of-memory errors via a crafted XML file...

GHSA-VWXJ-6M5M-RRVH The REST Plugin in Apache Struts is using an outdated XStream library

The REST Plugin in Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload...

SUSE-SU-2018:3080-1 Security update for libxml2

This update for libxml2 fixes the following security issues: - CVE-2018-9251: The xzdecomp function allowed remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint bsc1088279 - CVE-2018-14567: Prevent denial of...

SUSE-SU-2018:3081-1 Security update for libxml2

This update for libxml2 fixes the following security issues: - CVE-2018-9251: The xzdecomp function allowed remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint bsc1088279. - CVE-2018-14567: Prevent denial o...

CVE-2018-0414

A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML External Entities XXEs when parsing an XML file. An attack...

CVE-2018-0414 Cisco Secure Access Control Server XML External Entity Injection Vulnerability

A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML External Entities XXEs when parsing an XML file. An attack...

CVE-2018-0414 Cisco Secure Access Control Server XML External Entity Injection Vulnerability

A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML External Entities XXEs when parsing an XML file. An attack...

Python Denial of Service Vulnerability (CNVD-2018-20081)

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. There is a security vulnerability in Python. An attacker can exploit this vulnerability with the help of ...

DEBIAN-CVE-2018-14647

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming...

UBUNTU-CVE-2018-14647

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming...

PT-2018-1947 · Libexpat +7 · Expat +7

Name of the Vulnerable Software and Affected Versions: Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15 Description: The issue is related to Python's elementtree C accelerator failing to initialize Expat's hash salt during initialization...

Red Hat JBoss Core Services libxml2 Denial of Service Vulnerability (CNVD-2018-15905)

Red hat JBoss Core Services is the United States Red Hat Red Hat, Inc. provides a variety of intermediate section of the tool set. libxml2 is the GNOME project team developed a C-based language used to parse XML documents library, which supports a variety of encoding formats, Xpath parsing,...

CVE-2018-1000651

Stroom version 5.4.5 contains a XML External Entity XXE vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted XML file...

CVE-2016-9596

libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service stack consumption via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627...

Design/Logic Flaw

libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service stack consumption via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627...

CVE-2016-9598

libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service out-of-bounds read and application crash via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483...

libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS)

libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service out-of-bounds read and application crash via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483...

libxml2: stack exhaustion while parsing xml files in recovery mode (unfixed CVE-2016-3627 in JBCS)

libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service stack consumption via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627...

GHSA-Q7WX-62R7-J2X7 Nokogiri vulnerable to libxml XML Entity Expansion

The xmlreader in libxml allows remote attackers to cause a denial of service memory consumption via crafted XML data, related to an XML Entity Expansion XEE attack...

Nokogiri vulnerable to libxml XML Entity Expansion

The xmlreader in libxml allows remote attackers to cause a denial of service memory consumption via crafted XML data, related to an XML Entity Expansion XEE attack...