Mozilla Thunderbird XML Content Parsing Buffer Overflow Vulnerability

Mozilla Thunderbird is a mail tool adapted from the mail widget of the Mozilla browser. A buffer overflow vulnerability in Mozilla Thunderbird's handling of compressed XML content allows remote attackers to exploit the vulnerability by submitting a specially crafted HTML message that can be trick...

The vulnerability of the Gentoo Linux operating system, which allows a malicious intruder to compromise the accessibility of protected information

The vulnerability of the libxml2 package up to version 2.6.30-r1 in the Gentoo Linux operating system can lead to a violation of the accessibility of protected information. This vulnerability can be exploited remotely...

The vulnerability of the Libxml2 software library for analyzing XML documents lies in the fact that an out-of-bound operation can be executed, allowing an attacker to cause a service failure.

The vulnerability of the Libxml2 software library for analyzing XML documents relates to the execution of operations beyond the acceptable data buffer limits. Exploiting this vulnerability allows a malicious actor to cause service failures...

The vulnerability of the XML Security Library, related to bypassing authentication through spoofing, allows attackers to compromise data integrity.

The vulnerability of the XML Security Library relates to the bypassing of authentication mechanisms through spoofing. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid

It was found that the SecurityTokenService STS, provided as a part of Apache CXF, could under certain circumstances accept invalid SAML tokens as valid. A remote attacker could use a specially crafted SAML token to gain access to an application that uses STS for validation of SAML tokens...

Unspecified XXE Injection Vulnerability in IBM InfoSphere MDM Reference Data Management

IBM InfoSphere MDM Reference Data Management provides a range of capabilities essential for seamlessly managing reference data in the information world across different business domains, including comprehensive authoring and lifecycle management capabilities, a version control model, role-based...

MediaWiki Denial of Service Vulnerability (CNVD-2015-02419)

MediaWiki is a Wiki program. A security vulnerability exists in MediaWiki. When the program uses HHVM or Zend PHP, a remote attacker can exploit the vulnerability to cause a denial of service 'Quadratic Blowup' and memory corruption via an XML file containing entity declarations and multiple enti...

SAP Mobile Platform XXE Information Disclosure Vulnerability

SAP Mobile Platform is an enterprise mobility platform. SAP Mobile Platform suffers from an XXE External Entity Reference vulnerability that allows remote attackers to submit special XML to send requests to an internal server to obtain sensitive information...

UBUNTU-CVE-2015-0803

The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free...

Cagintranet Networks GetSimple CMS Cross-Site Scripting Vulnerability

Cagintranet Networks GetSimple CMS is an XML-based content management system from Cagintranet Networks, USA. The system includes a theme selector and editor, a component editor, image and file managers, and more. A cross-site scripting vulnerability exists in Cagintranet Networks GetSimple CMS th...

IBM Rational DOORS Next Generation and Rational Requirements Composer Denial of Service Vulnerabilities

IBM Rational DOORS Next Generation and Rational Requirements Composer are both requirements management solutions from IBM USA. The solutions are primarily used to define, manage, and report on requirements throughout the project lifecycle. A security vulnerability exists in the XML parser of IBM...

MyBB MyCode Editor Cross-Site Scripting Vulnerability

MyBB is a PHP-based forum program. A cross-site scripting vulnerability exists in the MyBB editor in versions prior to MyBB 1.8.4, which can be exploited by remote attackers to inject arbitrary Web script or HTML...

Java: Java XML Signature DoS Attack

It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions DTDs to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial ...

PNMsoft Sequence Kinetics Denial of Service Vulnerability

PNMsoft Sequence Kinetics is a next-generation business process management suite released by Israel-based PNMsoft that enables rapid establishment of high-availability workflow applications and close human collaboration on change while maintaining lifecycle governance. A denial of service...

CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods

It was found that Apache WSS4J Web Services Security for Java, as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of...

OpenJDK: XML parsing Denial of Service (JAXP, 8017298)

A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an...

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

IBM Tivoli Endpoint Manager HTML Injection Vulnerability

IBM Tivoli Endpoint Manager provides a unified, real-time visualization and implementation approach to deploying and managing patches to all endpoints. IBM Tivoli Endpoint Manager failed to properly filter user-submitted input, allowing remote attackers to exploit vulnerabilities to inject...

Apple TV and iOS XML Parser Buffer Overflow Vulnerability

Apple iOS is the latest operating system for Apple's iPhone and iPod touch devices. Apple TV is Apple's way of allowing photos, videos and music from PCs and iPods to be transmitted wirelessly to a TV in high definition. A buffer overflow vulnerability exists in the processing of XML files in App...

Unspecified Vulnerability in Oracle OpenSSO SAML Subpart (CNVD-2015-00552)

OpenSSO project is an open source implementation of SSO Single Sign-On for Web applications deployed on different Web or different servers to provide centralized authentication capabilities . Oracle OpenSSO SAML subcomponent has a security vulnerability that allows remote attackers to exploit the...