Denial Of Service (DoS)

Xerces2-j aka Apache Xerces-J parser is vulnerable to denial of service DoS. The attack can be triggered when malicious XML data is passed to Apache Xerces-J parser and processed by the JRE...

Denial Of Service (Dos)

libxml2 is vulnerable to denial of service. An attacker is able to crash the application via a malicious XML document containing malformed XPath expressions...

The vulnerability of the Qualcomm operating system Android component, which allows a hacker to trigger a buffer overflow in memory

The vulnerability of the Qualcomm Android operating system is related to array indexing errors. Exploiting this vulnerability can allow attackers to cause buffer overflows in memory by using malicious XML data in the firehose directory...

Apache Cayenne CayenneModeler XML External Entity Injection Vulnerability

Apache Cayenne is the United States Apache Apache Software Foundation of an open source persistence framework that provides object-relational mapping ORM and remote services . CayenneModeler is one of the graphical user interface . A security vulnerability exists in CayenneModeler in Apache Cayen...

XML External Entity (XXE)

retrofit is vulnerable to XML external entity XXE attacks. The vulnerability exists due to the lack of proper default configuration to disable support for external entities, allowing external files to be read and displayed when processing a malicious XML file...

Denial Of Service (DoS)

Xerces2-j aka Apache Xerces-J parser is vulnerable to denial of service DoS. The attack can be triggered when malicious XML data is passed to Apache Xerces-J parser and processed by the JRE...

XML External Entity Processing (XXE)

Apache OpenNLP is vulnerable to XML external entity processing XXE attacks. The attacks can be launched because it does not sanitize the XML in the input, allowing the attackers to parse models or dictionaries with malicious XML...

Flash Slideshow Maker Professional XSS / Content Forgery / Redirect

================================================================================= | | | | | | | | | | | |/' | / / / / | ' | /| | ' \ \ / | '| \ \ \ /\ / / | | | \ |/ / | | | | |./ / | | ./ /\ V V / || ||/|| || ||/ || / // C O N T A C T : Twitter: @ret2eax Email: [email protected] Blog:...

Supervisord -- An authenticated client can run arbitrary shell commands via malicious XML-RPC requests

mnaberez reports: supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability...

Heap-based Buffer Overread

The nokogiri gem contains a libxml2 package which is vulnerable to a heap-based buffer overread vulnerability. The vulnerability in libxml2 is referenced as CVE-2016-1833. Using a flaw in the htmlCurrentChar function, attackers can trigger the vulnerability using malicious XML input...

Heap-Based Buffer Overflow In Libxml2

nokogiri gem is using libxml2 which is vulnerable to CVE-2016-1834. The vulnerability exists when xmlStrlen returns a negative length in the xmlStrncat function. Therefore, it may lead to other attacks such as denial of service or arbitrary code execution through a heap-based buffer overflow usin...

Denial Of Service (DoS)

comet is vulnerable to denial of service DoS attacks. It is possible for an attacker to create a malicious XML document to parse, causing resource exhaustion when expanding XML entity...

Microsoft Event Viewer 1.0 - XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor: ================= www.microsoft.com Product: ======================== Microsoft Event Viewer Version: 1.0 The Windows Event Viewer shows a log of application and system messages – errors, informatio...

Remote DoS Exploit on JIRA

An attacker is able to perform the billion laughs attack on a default JIRA installation including OnDemand installations. This attack can be executed without authentication and leads to the complete use of resources on the victim machine causing the server to crash or hang. It is possible due to...

Ziepod+ 1.0 - CrossApplication Scripting

Ziepod+ 1.0 - CrossApplication Scripting !/usr/bin/python import thread import socket """ |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // |...

Opera Web Browser XML Denial Of Service Vulnerability (Windows)

The host is installed with Opera Web Browser and is prone to XML Denial of Service vulnerability. OpenVAS Vulnerability Test $Id: gboperaxmldosvulnwin.nasl 4869 2016-12-29 11:01:45Z teissa $ Opera Web Browser XML Denial Of Service Vulnerability Windows Authors: Nikita MR Copyright: Copyright c 20...

Ubuntu Update for libxslt vulnerabilities USN-633-1

Ubuntu Update for Linux kernel vulnerabilities USN-633-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN6331.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for libxslt vulnerabilities USN-633-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Gentoo Security Advisory GLSA 200903-19 (xerces-c)

The remote host is missing updates announced in advisory GLSA 200903-19. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Debian Security Advisory DSA 1654-1 (libxml2)

The remote host is missing an update to libxml2 announced via advisory DSA 1654-1. OpenVAS Vulnerability Test $Id: deb16541.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1654-1 libxml2 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

CVE-2007-6536

The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the 1 "Downloaded from" and 2 "Privacy considerations" sections without verifying domain names, which makes it easier for remote attackers to spoof domain names and trick users into installing...