63 matches found
PT-2025-37774
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.51 through 7.4.3.109 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 update 51 through update 92 Liferay DXP 7.3 update 33 through update 35 Description: A stored cross-site scripting XSS...
CVE-2022-42128
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API...
The vulnerability of the server for the Continuous Integration and Delivery system (CI/CD) of GoCD arises from incorrect restrictions on XML references to external objects. This allows attackers to perform XXE attacks.
The vulnerability of the CI/CD server of GoCD is related to an incorrect restriction on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...
PT-2025-1361 · Fortinet · Fortiswitch +16
Name of the Vulnerable Software and Affected Versions: FortiManager versions prior to 7.4.3 FortiMail versions prior to 7.0.3 FortiAnalyzer versions prior to 7.4.3 FortiVoice versions 7.0.0, 7.0.1 and prior to 6.4.8 FortiProxy versions prior to 7.0.4 FortiRecorder versions 6.4.0 through 6.4.2 and...
CVE-2024-55969
DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aka I640714...
PT-2024-36622 · Syncfusion · Syncfusion Essential Studio For Asp.Net Mvc
Name of the Vulnerable Software and Affected Versions: Syncfusion Essential Studio for ASP.NET MVC versions prior to 27.1.55 Description: The issue occurs when resaving a DOCX document with an external reference XML, resulting in an XMLException. This problem is present in the DocIO feature of...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the fact that any kunit in the drm/xe module that uses dmabuf for memory accesses should get its own externa...
CVE-2022-42128
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API...
CVE-2022-27593
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later...
Exploit for CVE-2022-30190
CVE-2022-30190EXPPowerPoint This is exploit of CVE-2022-301...
Exploit for CVE-2022-30190
CVE-2022-30190EXPPowerPoint This is exploit of CVE-2022-301...
Exploit for CVE-2022-30190
PoC exploit for CVE-2022-30190, an exploit module targeting the...
Exploit for CVE-2022-30190
CVE-2022-30190 Microsoft Office Word Rce 复现CVE-2022-30190...
Kubernetes: Broken Link Takeover from kubernetes.io docs
Report Submission Form Summary: Kubernetes docs has Spanish translation available. One of the page of Portuguese doc has an external reference to a github repository. The github account was not registered on github.com. So I was able to takeover the page and host the PoC Kubernetes Version: NA...
UBUNTU-CVE-2018-12475
A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-downloadfiles of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects:...
The vulnerability of the org.codehaus.jackson component in the jackson-mapper-asl library allows a attacker to compromise data integrity.
The vulnerability of the org.codehaus.jackson component in the jackson-mapper-asl library is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to compromise data integrity remotely...
CVE-2018-12243
The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity XXE exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths ...
Description of the security update for Excel 2016: April 10, 2018
None None...
CVE-2016-2945
The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...
CVE-2016-2945
The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...