The vulnerability of the XML method access determination module and XMLDOM, related to insufficient validation of input data, allows a malicious actor to gain unauthorized access to the application.

The vulnerability of the XML method access determination module and its XMLDOM control mechanism is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the application by sending specially crafte...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A type obfuscation vulnerability exists in versions of Google Chrome prior to V8 108.0.5359.71, which can be exploited by remote attackers to launch an attack via a crafted HTML page using heap corruption...

CVE-2022-45214

A cross-site scripting XSS vulnerability in Sanitization Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter at /php-sms/classes/Login.php...

XSS in Desktop Client in the notifications

None...

PT-2022-24906 · Nextcloud +2 · Nextcloud Desktop Client +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop client versions prior to 3.6.1 Description: An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. There are no known workarounds for this issue. Recommendations: For versions prior t...

CVE-2022-39332 Cross-site scripting (XSS) in Nextcloud Desktop Client

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for...

CVE-2022-39332

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for...

Security Bulletin: IBM Sterling Control Center is vulnerable to denial of service due to Websphere Liberty (CVE-2022-24839)

Summary IBM Sterling Control Center is vulnerable to potential a denial of service, caused by a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup in the fork of org.cyberneko.html. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to...

ZOHO ManageEngine ServiceDesk Plus 代码问题漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management, IT Project Management, Procurement and Contract Management, and...

The vulnerability of the TiXmlParsingData::Stamp function in the tinyxmlparser.cpp component, a XML parser for TinyXML, allows a attacker to cause a service failure.

The vulnerability of the TiXmlParsingData::Stamp function in the tinyxmlparser.cpp component of the TinyXML parser is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability allows a malicious actor to trigger a service failure through a specially...

GHSA-7X4W-J98P-854X Cross site scripting vulnerability with discussion titles

Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or...

PT-2022-23246 · WordPress · Spacer

Name of the Vulnerable Software and Affected Versions: Spacer WordPress plugin versions prior to 3.0.7 Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2022-27310 · Unknown · Appalti & Contratti

Name of the Vulnerable Software and Affected Versions: Appalti & Contratti version 9.12.2 Description: The web application is vulnerable to a Reflected Cross-Site Scripting issue. The idPagina parameter is reflected inside the server response without any HTML encoding, resulting in XSS when the...

CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum

Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title inpu...

CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum

Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title inpu...

GHSA-4598-WCG8-X56G XML External Entity Reference in Jenkins Violations Plugin

Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers to control XML input files for the 'Report Violations' post-build step to have agent processes parse a crafted file that uses external entities for extraction o...

PT-2022-27497 · Jenkins · Jenkins Cccc Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins CCCC Plugin version 0.6 and earlier Description: The issue is related to the configuration of the XML parser, which does not prevent XML external entity XXE attacks. Recommendations: For Jenkins CCCC Plugin version 0.6 and earlier,...

CLSA-2022-1668468696 php: Fix of 3 CVEs

CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation - CVE-2022-31630: Fix OOB read due to insufficient input validation in imageloadfont - CVE-2021-21707: Fix improper handlig of special character which breaks path in xml parsing...

OESA-2022-2080 libxml2 security update

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The outputcan be a simple SAX stream...

PT-2022-18317 · Intel · Quartus Prime Standard +1

Name of the Vulnerable Software and Affected Versions: IntelR Quartus Prime Pro and Standard edition software affected versions not specified Description: The issue concerns XML injection in the QuartusR Prime Programmer, which may allow an unauthenticated user to potentially enable information...