Improper restriction of XML external entity references (XXE) in Electronic Deliverables Creation Support Tool provided by Ministry of Defense

Overview Electronic Deliverables Creation Support Tool provided by Ministry of Defense improperly restricts XML external entity references XXE CWE-611. Toyama Taku of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

Electronic Delivery Check System Security Vulnerability

MAFF Electronic Delivery Check System is an electronic delivery check system from MAFF Japan. A security vulnerability exists in Electronic Delivery Check System Ver.14.0.001.002 and earlier versions, which stems from the handling of specially crafted XML files that may lead to the exposure of...

Ministry of Defense Electronic Deliverables Creation Support Tool Security Breach

Ministry of Defense Electronic Deliverables Creation Support Tool is an electronic deliverables creation support tool from Ministry of Defense, Japan. A security vulnerability exists in Ministry of Defense Electronic Deliverables Creation Support Tool Construction Edition version 1.0.4, Electroni...

The vulnerability of D-Link DCS-8300LHV2 Wi-Fi camera software allows a intruder to execute arbitrary code.

The vulnerability of D-Link DCS-8300LHV2 Wi-Fi cameras’ microprogramming software lies in the reading of data outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code during the syntactic analysis of XML elements...

NVIDIA DGX Security Vulnerability

NVIDIA DGX is a high-performance workstation for deep learning applications from NVIDIA. A security vulnerability exists in the NVIDIA DGX A100 Servers, which stems from an attacker could lead to an SMI markup vulnerability that could be used to execute arbitrary code at the SMM level...

OESA-2024-1017 tidy security update

When editing HTML it's easy to make mistakes. Wouldn't it be nice if there was a simple way to fix these mistakes automatically and tidy up sloppy editing into nicely laid out markup? Well now there is! Dave Raggett's HTML TIDY is a free utility for doing just that. It also works great on the...

Tiny Technologies TinyMCE Cross-Site Scripting Vulnerability

Tiny Technologies TinyMCE is a rich text editor from Tiny Technologies, USA. A cross-site scripting vulnerability exists in Tiny Technologies TinyMCE prior to version 5.9.0, which originates from an authenticated, remote attacker who can insert crafted HTML into the editor, resulting in the...

Mattermost Cross-site Scripting vulnerability

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client...

CVE-2023-7113

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client...

CVE-2023-7113

Mattermost CVE-2023-7113 affects Mattermost Server 8.1.6 and earlier due to improper sanitization of channel mention data in posts, enabling markup injection in the web client. Connected sources corroborate a cross-site scripting risk with versions before 8.1.7; upgrade to 8.1.7 (or later) is the...

Kantega SAML SSO OIDC Kerberos Security Vulnerability

Kantega SAML SSO OIDC Kerberos is an authentication plug-in from Kantega. A security vulnerability exists in Kantega SAML SSO OIDC Kerberos versions 4.4.2 through 4.14.8, 5.0.0 through 5.11.4, and 6.0.0 through 6.19.0, which stems from incorrect URL parameter cleanup that allows for HTML injectio...

Mattermost Cross-Site Scripting Vulnerability

Mattermost is an open source collaboration platform from US-based Mattermost. A security vulnerability exists in Mattermost versions 8.1.6 and earlier, which stems from an inability to clean data from posts, allowing an attacker to inject markup in the web client...

PT-2023-9194 · Unknown · Asp.Net Zero

Name of the Vulnerable Software and Affected Versions: Asp.Net Zero versions prior to 12.3.0 Description: The issue is related to an open redirect through HTML injection in user messages, allowing remote attackers to redirect targeted victims to any URL via the '' in the WebSocket messages. This...

The vulnerability of WebRTC implementations in Google Chrome and Microsoft Edge browsers allows attackers to execute arbitrary code or trigger service interruptions.

The vulnerability of WebRTC implementations in Google Chrome and Microsoft Edge stems from the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or trigger a service denial using a specially crafted malicious...

CVE-2023-48115

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request...

CVE-2023-6792

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...

The vulnerability of the My Calendar plugin of the WordPress content management system allows a hacker to execute arbitrary SQL queries against the database.

The vulnerability of the My Calendar plugin for the WordPress content management system is related to the lack of validation for the consistency of XML objects. Exploiting this vulnerability allows a remote attacker to execute arbitrary SQL queries against the database...

Umbraco Cross-Site Scripting Vulnerability

Umbraco is an open source Content Management System CMS written in C by the Danish company Umbraco. Umbraco suffers from a cross-site scripting vulnerability that originates from a user with access to specific parts of the backend being able to inject HTML code into unwanted forms...

DoraCMS 安全漏洞

DoraCMS is a software application. Based on Nodejs+eggjs+mongodb to write a content management system . A cross-site scripting XSS vulnerability exists in DoraCMS version v2.1.8. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially crafted HTML or image fi...

Qualys Web Application Cross-Site Scripting Vulnerability

Qualys Web Application is a web application from Qualys, Inc. A cross-site scripting vulnerability exists in Qualys Web Application versions prior to 10.24.0.0, which arises from a lack of HTML coding when presenting logging information to a user, allowing a user with login access to the...