ezXML Heap Buffer Over Read Vulnerability

ezXML is a C library for parsing XML documents . A heap buffer over-read vulnerability exists in ezXML. The vulnerability stems from the ezxmldecode function performing incorrect memory handling when parsing specially crafted XML files. An attacker could exploit this vulnerability to cause a deni...

ezXML Stack Overflow Vulnerability

ezXML is a C library for parsing XML documents . A stack overflow vulnerability exists in ezXML. The vulnerability stems from the ezxmlentok function not handling recursion correctly. An attacker could exploit this vulnerability via a specially crafted XML file to cause a denial of service...

ezXML Null Pointer Dereference Vulnerability

ezXML is a C library for parsing XML documents . A null pointer dereference vulnerability exists in ezXML. The vulnerability stems from the ezxmldecode function performing incorrect memory handling when parsing specially crafted XML files. An attacker could exploit this vulnerability to cause a...

The vulnerability of the XMLFileLookupService component in the Apache NiFi data processing platform allows a hacker to gain unauthorized access to protected information.

The vulnerability of the XMLFileLookupService component in the Apache NiFi data processing platform is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protecte...

The vulnerability of Netweaver Application Server Java web applications lies in insufficient validation of requests on the server side, allowing attackers to expose privileged user credentials.

The vulnerability of Netweaver Application Server Java web applications is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to obtain privileged user credentials by using a specially created XML file...

Google Chrome Information Disclosure Vulnerability (CNVD-2019-46754)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an information disclosure vulnerability. The vulnerability can be exploited by an attacker to disclose cross-origin data through specially crafted HTML pages...

The vulnerability of the V8 component in the Google Chrome browser allows a hacker to trigger a service failure.

The vulnerability of the V8 component in Google Chrome browser is related to reading beyond the buffer limit. Exploiting this vulnerability can allow a malicious actor to cause a service failure through a specially created HTML page...

The vulnerability of Google Chrome arises from insufficient validation of input data, allowing a hacker to replace the user’s interface in the “Extensions” tab.

The vulnerability of Google Chrome exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to replace the user interface in the “Extensions” tab using a specially created HTML page...

XML Entity Injection Vulnerability in Apache Commons-digester Component

Apache is web server software.Commons-digester is Apache is a component that converts XML into JAVA beans. An XML entity injection vulnerability exists in the Apache Commons-digester component. By constructing malicious content, an attacker can cause arbitrary files to be read and system commands...

DEBIAN-CVE-2019-5881

Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

jackson-mapper-asl XML External Entity Vulnerability

jackson-mapper-asl is a data mapping package built on the Jackson JSON processor. An XML external entity vulnerability exists in version 1.9.x of jackson-mapper-asl. No detailed vulnerability details are provided at this time...

The vulnerability of the Enterprise Resource Management System “Galaktika ERP” allows a hacker to initiate requests for resources on behalf of the server.

The vulnerability of the .res components of the Enterprise Resource Management System “Galaktika ERP” is related to the functionality of importing XML configurations. Exploiting this vulnerability allows a malicious actor to initiate requests to any resource on behalf of the server by performing...

infinispan: deserialization of data in XML and JSON transcoders

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possibl...

XML Entity Injection Vulnerability in Panmicro E-cology

Panmicro Collaborative Management Application Platform e-cology is a collaborative business platform with enterprise information portal, knowledge management, data center, workflow management, human resource management, customer and partner management, project management, financial management, an...

Cryptocat Input Validation Error Vulnerability (CNVD-2019-40145)

Cryptocat is an open source online cryptographic chat application. A security vulnerability exists in versions of Cryptocat prior to 2.0.22. An attacker can exploit this vulnerability to cause the application to generate invalid HTML code...

CVE-2019-13496

One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defender product, and replacing a failed SAML response with a successful SAML response...

ClipSoft REXPERT XML Injection Vulnerability

ClipSoft REXPERT is a report generation program from ClipSoft Korea. An injection vulnerability exists in ClipSoft REXPERT XML. An attacker can exploit this vulnerability to create and execute arbitrary files via the report printing function...

chromium-browser: Chrome web store origin needs to be isolated

Insufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page...

The vulnerability of the syntactic analyzer of the Microsoft XML Core Services for Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the syntactic analyzer of the Microsoft XML Core Services for Windows operating systems is related to errors in processing user input. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by having the user open a specially created web page...

Mozilla: Incorrect HTML parsing results in XSS bypass technique

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...