The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to compromise data integrity, gain unauthorized access to protected information, and cause service failures.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine arises from an operation that occurs outside the buffer in memory. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service failures through a...

The vulnerability of Google Chrome, related to errors in inheriting security policies for new documents, allows a perpetrator to compromise the integrity of data.

The vulnerability of Google Chrome is related to errors in inheriting security policies for new documents. Exploiting this vulnerability can allow a malicious actor to compromise data integrity through a specially created HTML page...

PT-2019-5892 · Reportlab +4 · Reportlab +4

Name of the Vulnerable Software and Affected Versions: ReportLab versions prior to 3.5.27 Description: The issue is related to the toColorevalarg function in the ReportLab library, which is connected to an error in processing XML documents. This can be exploited by a remote attacker to gain acces...

The vulnerability of the XSLT implementation for converting XML documents in Firefox browsers allows attackers to trigger a service failure or execute arbitrary code.

The vulnerability of the XSLT transformation language for XML documents in Firefox browsers arises due to incorrect checking of number formatting boundaries during formatting operations. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

CVE-2008-5646

Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain wiki markup."...

PT-2019-17122 · Ibm · Ibm Security Directory Server

Name of the Vulnerable Software and Affected Versions: IBM Security Directory Server version 6.4.0 Description: The issue allows attackers to modify the syntax, content, or commands of the XML before it is processed by an end system, due to the improper neutralization of special elements used in...

The vulnerability of the libexpat function in the C language library, which is used for performing XML parsing, allows an attacker to cause a denial-of-service attack.

The vulnerability of the libexpat function in the C language library for performing XML parsing in Expat involves the XML parser itself, which consumes a large amount of memory and CPU resources. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

The vulnerability of the SAML broker component of the Keycloak identity and access management software allows a malicious actor to gain unauthorized access to the system.

The vulnerability of the SAML broker component in the Keycloak identity and access management software is related to incorrect authentication processes. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the system by modifying the SAML...

USN-4132-2 expat vulnerability

USN-4132-1 fixed a vulnerability in Expat. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive...

CVE-2019-1257

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1295, CVE-2019-1296...

Remote code execution

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1295, CVE-2019-1296...

Mozilla: XSS by breaking out of title and textarea elements using innerHTML

Some HTML elements, such as title and textarea, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if...

DEBIAN-CVE-2019-15903

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read...

CVE-2019-15637

Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop...

Cisco Adaptive Security Appliance VPN SAML Authentication Bypass Vulnerability (cisco-sa-20190501-asaftd-saml-vpn)

According to its self-reported version the Cisco Adaptive Security Appliance ASA software running on the remote device is affected by an authentication bypass vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 Single Sign-On SSO for Clientless SSL VPN WebVPN and...

IBM Security Guardium Big Data Intelligence XML External Entity Injection Vulnerability

IBM Security Guardium Big Data Intelligence SonarG is a suite of big data security intelligence solutions from IBM, USA. The solution features interactive data exploration, automated connectivity analysis, and user activity analysis. An XML external entity injection vulnerability exists in IBM...

PT-2019-17081 · Ibm · Ibm Infosphere Global Name Management +1

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Global Name Management versions 5.0 through 6.0 IBM InfoSphere Identity Insight versions 8.1 through 9.0 Description: The issue allows a remote attacker to exploit an XML External Entity Injection XXE attack when processing XML...

XML Entity Injection Vulnerability in S-CMS

S-CMS is Zibo Shining Network Technology Co., Ltd. developed a solution for enterprise station-building products. S-CMS has an XML entity injection vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2019-10374

A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI...

PYSEC-2019-11

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability i...