Apache NiFi SplitXML processor code execution vulnerability

Apache NiFi is the United States Apache Apache Software Foundation of a set of data flow-based data processing and distribution system. The system supports the configuration and transformation of data routing indicator maps and system intermediary logic , etc. SplitXML processor is one of the XML...

Redhat Mobile Application Platform HTML Injection Vulnerability

RHMAP is a mapping statistics package. app Studio component is one of the app development components. A security vulnerability exists in the App Studio component in RHMAP version 4.4. An attacker can exploit the vulnerability to execute script code or HTML in the context of a browser...

Microsoft PowerPoint Remote Code Execution Vulnerability (CNVD-2018-10942)

Microsoft Office 2016 for Mac is a Mac-based office software suite product developed by Microsoft Corporation in the U.S. PowerPoint is a document presentation tool in the Office suite. A security vulnerability exists in PowerPoint in Microsoft Office 2016 for Mac-based platforms, which stems fro...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

CVE-2018-10832

ModbusPal 1.6b is vulnerable to an XML External Entity XXE attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will retu...

Pulse Secure Pulse Connect Secure Denial of Service Vulnerability

Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure, a US-based company. A security vulnerability exists in Pulse Connect Secure versions 8.1.x prior to 8.1R14, 8.2.x prior to 8.2R11, and 8.3.x prior to 8.3R5, which stems from the...

CVE-2018-9849

Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service memory consumption and memory errors via a crafted XML document...

VirtueMart Cross-Site Scripting Vulnerability

VirtueMart is an open source e-commerce solution compatible with Joomla! The solution supports 128-bit HTTPS encryption, support for different language switching and currency switching and other features. A cross-site scripting vulnerability exists in versions prior to VirtueMart 3.2.14. A remote...

CVE-2018-10213

An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a different user, who can modify the HTML in that mail before sending it...

Atlassian atlassian-renderer wiki markup component cross-site scripting vulnerability

Atlassian atlassian-renderer is a renderer from the Australian company Atlassian. wiki markup is one of the wiki text markup components. A security vulnerability exists in the wiki markup component in Atlassian atlassian-renderer version 8.0.0 prior to 8.0.22. A remote attacker can exploit this...

[SECURITY] Fedora 27 Update: python-bleach-2.1.3-1.fc27

Bleach is an HTML sanitizing library that escapes or strips markup and attributes based on a white list...

CVE-2017-18102

The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup...

CVE-2017-18102

The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup...

CVE-2017-18102

The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup...

XSS in various types of nested wiki markup - CVE-2017-18102

The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup...

XSS in various types of nested wiki markup - CVE-2017-18102

The bundled version of atlassian-renderer in Atlassian JIRA before version 7.7.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup. For more information see https://jira.atlassian.com/browse/RNDR-153 currently...

CVE-2018-6660

Directory Traversal vulnerability in McAfee ePolicy Orchestrator ePO 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file...

CVE-2018-9031

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "ifpwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side...

textpattern denial of service vulnerability

textpattern is an excellent blogging system. A security vulnerability exists in the Import XML feature in textpattern version 4.6.2. An attacker can exploit this vulnerability by uploading a specially crafted XML file to cause a denial of service exhaustion of server memory resources...