PT-2020-5531 · Apache +2 · Log4Net +2

Name of the Vulnerable Software and Affected Versions: Apache log4net versions prior to 2.0.10 Description: The issue is related to errors in restricting XML links to external objects XXE in the log4net logging library on the .NET Framework platform. Exploitation of this issue may allow a remote...

This Asia-Pacific Cyber Espionage Campaign Went Undetected for 5 Years

An advanced group of Chinese hackers has recently been spotted to be behind a sustained cyber espionage campaign targeting government entities in Australia, Indonesia, Philippines, Vietnam, Thailand, Myanmar, and Brunei—which went undetected for at least five years and is still an ongoing threat...

Cisco Hosted Collaboration Mediation Fulfillment Code Issue Vulnerability

Cisco Hosted Collaboration Mediation Fulfillment HCM-F is a core management component of a Hosted Collaboration Solution HCS from Cisco. The product provides inventory management, license management, and service provider toolkit. A code issue vulnerability exists in Cisco Hosted Collaboration...

PT-2020-2513 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC Software affected versions not specified Description: The issue is related to improper input validation of HTTP request parameters in the web interface, allowing an unauthenticated, remote attacker to...

DEBIAN-CVE-2020-10683

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

UBUNTU-CVE-2020-10683

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

CVE-2020-7131

This document describes a security vulnerability in Blade Maintenance Entity, Integrated Maintenance Entity and Maintenance Entity products. All J/H-series NonStop systems have a security vulnerability associated with an open UDP port 17185 on the Maintenance LAN which could result in information...

CVE-2020-11820

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entitiesid parameter...

Cross-site Scripting (XSS)

mysql is vulnerable to cross-site scripting XSS. The vulnerability exists as an insufficient HTML entities quoting flaw was found in the mysql command line client's HTML output mode. If an attacker was able to inject arbitrary HTML tags into data stored in a MySQL database, which was later...

Django: the behavior of the underlying HTMLParser leading to DoS

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities...

AppTrana Offers Protection to Online Businesses During Coronavirus Outbreak

These are unprecedented times, and everyone is going through a testing period, with more than 3 billion people locked down all over the world. Businesses are scrambling to stay afloat and are forced to move digital in a very short span of time without much preparation. As these businesses move...

CVE-2019-11763

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...

XML External Entity (XXE)

AutoUpdater.NET is vulnerable to XML External Entity XXE. The vulnerability exists as the XML parser used in AutoUpdater does not properly restrict resolving XML external entities...

GHSA-R6J9-8759-G62W Improper Restriction of XML External Entity Reference in jackson-mapper-asl

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar to CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

Cross-Site Scripting (XSS)

viewerjs is vulnerable to cross-site scripting XSS attacks. This is due to a lack of escaping on user input HTML entities such as alt, src and url. An attacker could use this flaw to inject and execute arbitrary Javascript in a user's browser...

Design/Logic Flaw

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

CVE-2020-8086

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

CVE-2020-8086

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

CVE-2020-7595

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation...

XML External Entity (XXE)

mybatis-generator-core is vulnerable to XML External Entity XXE attacks. The vulnerability exists because the 'parseConfiguration' function in 'ConfigurationParser' does not restrict fetching and processing of external XML resources, allowing an attacker to inject and process malicious external...