CVE-2021-26892 Windows Extensible Firmware Interface Security Feature Bypass Vulnerability

...

CVE-2021-26892

Technical details about CVE-2021-26892 (affected product, root cause, impact, fixes) are not provided in the connected documents; no public details are included here. Monitor for updates.

Siemens Solid Edge 代码问题漏洞

Siemens Solid Edge is a 3D CAD software from Siemens, Germany. The software can be used for part design, assembly design, sheet metal design, welding design and other industries. Siemens Solid Edge suffers from an XML external entity reference vulnerability. The vulnerability stems from when...

PT-2021-2275 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a security feature bypass vulnerability in the Windows Extensible Firmware Interface. This vulnerability allows attackers to bypass existing security restrictions...

Microsoft Windows 安全漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation. A security vulnerability exists in the Windows Extensible Firmware Interface. The following products and editions are affected:Windows 10 Version 1607 for x64-based...

[SECURITY] Fedora 33 Update: libebml-1.4.2-1.fc33

Extensible Binary Meta Language access library A library for reading and writing files with the Extensible Binary Meta Language, a binary pendant to XML...

[SECURITY] Fedora 32 Update: libebml-1.4.2-1.fc32

Extensible Binary Meta Language access library A library for reading and writing files with the Extensible Binary Meta Language, a binary pendant to XML...

CVE-2021-28040

An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in osxml.c occurs when a large number of opening and closing XML tags is used. Because recursion is used in ReadElem without restriction, an attacker can trigger a segmentation fault once unmapped memory is reached...

CVE-2021-26969

A remote authenticated authenticated xml external entity xxe vulnerability was discovered in Aruba AirWave Management Platform versions: Prior to 8.2.12.0. Due to improper restrictions on XML entities a vulnerability exists in the web-based management interface of AirWave. A successful exploit...

jenkins: Arbitrary file existence check in file fingerprints

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path...

The vulnerability of the Nokogiri library lies in the improper limitation of XML links to external objects, which allows attackers to perform SSRF attacks or XXE attacks.

The vulnerability of the Nokogiri library is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack or an XXE attack...

Kaspersky Security Vulnerabilities

Kaspersky module is an application component of the Russian company Kaspersky Kaspersky. It provides antivirus protection. A security vulnerability exists in Kaspersky that allows loading of untrusted UEFI modules due to their insufficient authenticity checks...

The vulnerability of the Junos operating system’s EVPN/VXLAN technology allows a attacker to trigger a service failure.

The vulnerability of the EVPN/VXLAN technology implementation in Junos routers of the QFX10K series lies in the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2020-35852

Chatbox is affected by cross-site scripting XSS. An attacker has to upload any XSS payload with SVG, XML file in Chatbox. There is no restriction on file upload in Chatbox which leads to stored XSS...

CVE-2021-27184

Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability exploitable via the DTD parameter entities technique, resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input passed to...

[SECURITY] Fedora 32 Update: libebml-1.4.1-1.fc32

Extensible Binary Meta Language access library A library for reading and writing files with the Extensible Binary Meta Language, a binary pendant to XML...

Cisco FXOS Software Firepower Chassis Manager XSRF (cisco-sa-fxosfcm-csrf-uhO4e5BZ)

According to its self-reported version, Cisco Firepower Extensible Operating System FXOS is affected by a cross-site request forgery vulnerability. The vulnerability is due to insufficient CSRF protections for the FCM interface. An unauthenticated, remote attacker can exploit this vulnerability b...

[SECURITY] Fedora 33 Update: libebml-1.4.1-1.fc33

Extensible Binary Meta Language access library A library for reading and writing files with the Extensible Binary Meta Language, a binary pendant to XML...

The vulnerability of the software control panel of Cisco Firepower Management Center (FMC) allows a intruder to trigger a service failure.

The vulnerability of the Cisco Firepower Management Center’s software management panel is related to errors in processing XML objects. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

UBUNTU-CVE-2021-23926

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0...