3669 matches found
PT-2024-21798
Name of the Vulnerable Software and Affected Versions Docassemble versions prior to 1.4.97 Description The issue allows a user to type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The HTML can also contain tags, allowing...
PYSEC-2024-162
A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...
UBUNTU-CVE-2024-1892
A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...
USN-6658-1 libxml2 vulnerability
It was discovered that libxml2 incorrectly handled certain XML documents. A remote attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code...
The vulnerability of the XML syntax analyzer library libexpat, related to uncontrolled resource consumption, allows a hacker to cause a service failure.
The vulnerability of the XML syntax analyzer library libexpat is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
Pyhtml2pdf Cross-Site Scripting Vulnerability
Pyhtml2pdf is a simple python wrapper from the Python Foundation. Convert HTML to PDF using headless Chrome via selenium. A cross-site scripting vulnerability exists in Pyhtml2pdf version 0.0.6, which stems from not validating user-entered HTML content, resulting in an attacker being able to obta...
CVE-2024-24743
SAP NetWeaver AS Java CAF - Guided Procedures - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so...
SAP NetWeaver AS Code Issue Vulnerability
SAP NetWeaver AS is a SAP network application server from SAP. It not only provides web services, but is also the basic platform for SAP software. A code issue vulnerability exists in SAP NetWeaver AS Java version 7.50, which arises from a vulnerability that allows an unauthenticated attacker to...
The vulnerability of the Qualys Policy Compliance Connector Plugin lies in the improper restriction of XML links to external objects, which allows attackers to perform XXE attacks.
The vulnerability of the Qualys Policy Compliance Connector Plugin is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute XXE attacks using specially created XML code...
santuario: Private Key disclosure in debug-log output
All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...
The vulnerability of Google Chrome’s Skia graphic library allows a hacker to execute arbitrary code.
The vulnerability of Google Chrome’s Skia graphics library is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created HTML page...
Hibernate Validator Security Vulnerability
Hibernate Validator is a parameter validation framework from Hibernate. A security vulnerability exists in Hibernate Validator that stems from the fact that browsers may render invalid html...
Microsoft Edge’s vulnerability, related to security configuration errors, allows a hacker to bypass the sandbox protection mechanism and execute arbitrary code.
The vulnerability of Microsoft Edge relates to errors in security settings when processing HTML content. Exploiting this vulnerability allows a malicious actor to bypass sandbox protections and execute arbitrary code using a specially created file or web page...
ALPINE-CVE-2023-52426
libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...
Don't Muck My Markup <= 1.8 - Cross-Site Request Forgery
Description The Don't Muck My Markup plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform unauthorize...
SEW-EURODRIVE MOVITOOLS MotionStudio Code Issue Vulnerability
SEW-EURODRIVE MOVITOOLS MotionStudio is an engineering software from SEW-EURODRIVE. A security vulnerability exists in SEW-EURODRIVE MOVITOOLS MotionStudio version 6.5.0.2, which originates from the possibility of unrestricted file access when processing XML messages...
WordPress Don't Muck My Markup Plugin <= 1.8 is vulnerable to Cross Site Request Forgery (CSRF)
Software Don't Muck My Markup Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-23510 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9934a7f8d741 Credits Nguyen Xuan Chien...
OpenText AppBuilder Code Issue Vulnerability
OpenText AppBuilder is an application from OpenText Canada. A security vulnerability exists in OpenText AppBuilder versions 21.2 through 23.2, which originates from XML External Entity Injection and allows server-side requests to forge, probe system files...
