IBM Rational Rhapsody Design Manager XML External Entity Injection Vulnerability

IBM Rational Rhapsody Design Manager is a Jazz-based platform from IBM that helps systems engineers apply Model-Based Systems Engineering MBSE through SysML to help embedded software developers dismantle engineering silos and collaborate with key stakeholders, such as managers, quality managers,...

IBM Integration Bus and WebSphere Message Broker XML External Entity Injection Vulnerability

IBM Integration Bus formerly known as IBM WebSphere Message Broker is an enterprise service bus ESB product from IBM. The product provides connectivity and common data transformations for Service Oriented Architecture SOA environments and non-SOA environments. An XML external entity injection...

CVE-2017-5019

A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Cimetrics BACnet Explorer XML External Entity Injection Vulnerability

BACnet Explorer is a BACnet client application that helps to automatically discover BACnet devices. Cimetrics BACnet Explorer suffers from an XML external entity injection vulnerability that can be exploited by an attacker to obtain sensitive information...

DEBIAN-CVE-2016-4571

The mxmlwritenode function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service stack consumption via crafted xml file...

w3m denial of service vulnerability (CNVD-2016-13124)

w3m is an open source text-based Web browser . A security vulnerability exists in versions of w3m prior to 0.5.3-33. A remote attacker can exploit this vulnerability to cause a denial of service segmentation error and crash with the help of specially crafted HTML pages...

libxml2: Heap-based buffer overread in htmlCurrentChar

The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document...

CVE-2016-4026

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The content sanitizer component has an issue with filtering malicious content in case invalid HTML code is provided. In such cases the filter will output a unsanitized representation of the content. Malicious script code can...

DEBIAN-CVE-2016-9631

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service segmentation fault and crash via a crafted HTML page...

Microsoft PowerShell XML External Entity Injection Vulnerability

Microsoft PowerShell is a command line scripting environment that runs on windows machines to automate system and application management. An XML external entity injection vulnerability exists in Microsoft PowerShell, which can be exploited by an attacker to obtain sensitive information and execut...

Microsoft Windows Media Center 'ehshell.exe' XML External Entity Injection Vulnerability

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. Windows Media Center is one of these multimedia applications. Microsoft Windows Media Center V6.1.7600 'ehshell.exe' suffers from an XML External Entity Injection vulnerability that can be exploited b...

UBUNTU-CVE-2016-9063

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox 50...

php: libxml_disable_entity_loader setting is shared between threads

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxmldisableentityloader changes in other threads, which allows remote attackers to conduct XML External Entity XXE and XML Entity Expansion XEE attacks via a crafted XML...

The vulnerability of the Cisco IOS operating system allows a hacker to inject any desired Web or HTML code.

The vulnerability of the Cisco IOS operating system allows a hacker to inject any desired Web or HTML code...

Libxml2 memory corruption vulnerability in multiple Apple products (CNVD-2016-08340)

Apple iOS, OS X, tvOS, and watchOS are all products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Apple OS X is a specialized operating system developed for Mac computers; tvOS is a smart TV operating system; and watchOS is a smart watch operating system. Libxml2 is...

PT-2016-6202

Name of the Vulnerable Software and Affected Versions OpenStack Murano versions prior to 1.0.3 liberty and prior to 2.0.1 mitaka Murano-dashboard versions prior to 1.0.3 liberty and prior to 2.0.1 mitaka python-muranoclient versions prior to 0.7.3 liberty and prior to 0.8.5 mitaka Description The...

IBM Rational Quality Manager and Collaborative Lifecycle Management Command Injection Vulnerability

IBM Rational Quality Manager RQM and Collaborative Lifecycle Management CLM are both products of IBM Corporation. The former is a set of collaborative, Web-based quality management solutions, the latter is a set of collaborative lifecycle management solutions. A command injection vulnerability...

Polycom HDX Video End Points XML External Entity Denial of Service Vulnerability

Polycom HDX Video End Points video conferencing system. A denial of service vulnerability exists in Polycom HDX Video End Points. An attacker could exploit this vulnerability to cause a denial of service condition...

jenkins: Remote code execution through remote API (SECURITY-247)

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

The vulnerability of the Microsoft .NET Framework software platform, which allows a hacker to read arbitrary files

The vulnerability of the Microsoft .NET Framework software platform is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to read arbitrary files using XML data, which contains a declaration of an external object along with a reference to an...