UBUNTU-CVE-2021-30485

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxmlinternaldtd, while parsing a crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running strcmp on a NULL pointer...

CVE-2019-25026

Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting...

CVE-2019-25026

Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting...

CVE-2019-25026

Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting...

UBUNTU-CVE-2019-25026

Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting...

CVE-2019-25026

CVE-2019-25026 affects Redmine prior to 3.4.13 and 4.x prior to 4.0.6, where Textile formatting mishandles markup data. The connected advisories attribute a risk of cross-site scripting, information disclosure, and reading arbitrary files from the server. Mitigation per public advisories is to up...

CVE-2019-25026

Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting...

DEBIAN-CVE-2021-30154

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header- messages are output in HTML unescaped, leading to XSS...

Ruby 路径遍历漏洞

Ruby is a cross-platform, object-oriented, dynamically typed programming language from the individual developer, Yukihiro Matsumoto. A path traversal vulnerability exists in REXML in Ruby 2.5.9, which stems from the fact that parsing and serializing a carefully crafted XML document may create an...

Composr CMS 跨站脚本漏洞

Composr is an open source content management system CMS with advanced social, interactive and dynamic features. A cross-site scripting vulnerability exists in Composr version 10.0.36. The vulnerability can be exploited to conduct cross-site scripting attacks via XML scripts...

CVE-2021-24208

The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets though the custom HTML widget requires sending a crafted request - it appears that this...

Google Chrome 资源管理错误漏洞

Chrome is a simple and efficiently designed web browsing tool developed by Google. A post-release reuse vulnerability exists in screen captures in versions prior to Google Chrome 89.0.4389.114. A programmed attacker can exploit this vulnerability to cause heap damage via a crafted HTML page...

CVE-2021-20482

IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197504...

The vulnerability of the ParserParseDocument() function in UPnP device sets allows a hacker to trigger a service failure.

The vulnerability of the ParserParseDocument function for UPnP devices is related to errors in processing XML entities. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Compass Plus e-Commerce Payment Gateway 代码问题漏洞

Compass Plus e-Commerce Payment Gateway is an application interface of the Russian company Compass Plus. It provides an API interface for payment functions. A security vulnerability exists in TranzWare e-Commerce Payment Gateway before 3.1.27.5, which is caused by a vulnerability in the XML parse...

GitLab 未授权RCE漏洞（CVE-2021-22192）

When rendering wiki content with certain extensions such as .rmd, renderwikicontent will call othermarkupunsafe which will end up calling GitHub::Markup.render from the github-markup gem. Files with any extension can be uploaded by checking out the wiki with git, commiting the files and pushing t...

Siemens Solid Edge 代码问题漏洞

Siemens Solid Edge is a 3D CAD software from Siemens, Germany. The software can be used for part design, assembly design, sheet metal design, welding design and other industries. Siemens Solid Edge suffers from an XML external entity reference vulnerability. The vulnerability stems from when...

IBM WebSphere Application Server路径遍历漏洞

IBM WebSphere Application Server WAS is by IBM in accordance with open standards, such as Java EE, XML and Web Services, development and distribution of an application server. A directory traversal vulnerability exists in IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0. An attacker can...

CVE-2021-28040

An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in osxml.c occurs when a large number of opening and closing XML tags is used. Because recursion is used in ReadElem without restriction, an attacker can trigger a segmentation fault once unmapped memory is reached...

CVE-2021-26969

A remote authenticated authenticated xml external entity xxe vulnerability was discovered in Aruba AirWave Management Platform versions: Prior to 8.2.12.0. Due to improper restrictions on XML entities a vulnerability exists in the web-based management interface of AirWave. A successful exploit...