MiracleLinux 3 : xerces-j2-2.7.1-7jpp.2.3AXS3 (AXSA:2009-426:01)

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2009-426:01 advisory. Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces...

EUVD-2020-0452

Malware in sbrugna...

EUVD-2017-16487

Malware in sbrugna...

EUVD-2018-3307

Malware in sbrugna...

EUVD-2022-52797

Malicious code in bioql PyPI...

EUVD-2021-8874

Malicious code in bioql PyPI...

REXML has a DoS condition when parsing malformed XML file

...

GHSA-C2F4-JGMC-Q2R5 REXML has DoS condition when parsing malformed XML file

Impact The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches REXML gems 3.4.2 or later include the patches to fix these vulnerabilities...

USN-7753-1: xmltodict vulnerability

Camilo Vera discovered that xmltodict parsed maliciously crafted XML input, contrary to expectations. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or execute arbitrary code...

CVE-2009-2668

Microsoft Internet Explorer 6 through 6.0.2900.2180 and 7 through 7.0.6000.16473 allows remote attackers to cause a denial of service CPU consumption via an XML document composed of a long series of start-tags with no corresponding end-tags, a related issue to CVE-2009-1232...

BIT-PHP-MIN-2021-21702 Null Dereference in SoapClient

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash...

USN-7199-1 libxmltok vulnerabilities

It was discovered that Expat, contained within the xmltok library, incorrectly handled malformed XML data. If a user or application were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. CVE-2015-1283, CVE-2016-0718,...

USN-7199-1: xmltok library vulnerabilities

It was discovered that Expat, contained within the xmltok library, incorrectly handled malformed XML data. If a user or application were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. CVE-2015-1283, CVE-2016-0718,...

PT-2024-20170 · Unknown · Merge Dicom Toolkit C/C++

Name of the Vulnerable Software and Affected Versions: Merge DICOM Toolkit C/C++ affected versions not specified Description: The issue arises from the use of a deprecated function, MC XML To Message, which can lead to memory access violations when processing malformed DICOM XML files. This occur...

BIT-PHP-2021-21702 Null Dereference in SoapClient

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash...

PT-2024-40852 · Libxml2 · Libxml2

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This error is specifically a READ 8 type, indicatin...

CVE-2023-29443

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint...

USN-5638-4 expat vulnerabilities

USN-5638-1 fixed several vulnerabilities in Expat. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Rhodri James discovered that Expat incorrectly handled memory when processing certain malformed XML files. An attacker could possibly use this issue to...

SUSE CVE-2008-2956

Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service memory consumption via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem...

SUSE CVE-2009-2625

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service infinite loop and application hang via malformed XML input, as...