Apache Roller XML-RPC protocol support XML injection vulnerability

Apache Roller is the United States Apache Apache Software Foundation's set of feature-rich multi-user blogging platform. XML-RPC protocol support is one of the XML-RPC transport protocol support component. A security vulnerability exists in the XML-RPC protocol support in Apache Roller versions...

Catalyst Mahara Cross-Site Scripting Vulnerability (CNVD-2017-36223)

Catalyst Mahara is a social networking system from Catalyst IT in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Catalyst Mahara. An attacker can exploit this vulnerability with a maliciously created .xml file to execute code wh...

CVE-2017-15950

Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by providing a long input into the "Destination directory" field, either within an XML document or through use of passive mode...

Apache OpenNLP XXE Vulnerability

Apache OpenNLP is the United States Apache Apache Software Foundation developed a toolkit based on machine learning for processing natural language text. A security vulnerability exists in Apache OpenNLP. An attacker could exploit this vulnerability to conduct XML external entity injection attack...

Google Chrome omnibox content spoofing vulnerability (CNVD-2017-33599)

Google Chrome for Mac, Windows and Linux is a web browser developed by Google for Mac, Windows and Linux platforms.Omnibox is one of the real-time search engines. A security vulnerability exists in Omnibox in Google Chrome on Linux, Windows and Mac platforms. A remote attacker can exploit this...

CVE-2017-5104

Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via a crafted HTML page...

UBUNTU-CVE-2017-5117

Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Linux and Windows allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

UBUNTU-CVE-2017-5088

Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page...

actionpack Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML...

OpenMRS Remote Command Execution Vulnerability

OpenMRS Reference Application is a suite of open source EHR applications.Reporting Compatibility Add On is one of the compatibility reporting components. A remote command execution vulnerability exists in OpenMRS, which is caused by the application failing to authenticate the user when...

chromium-browser: incorrect stack manipulation in webassembly

Inappropriate implementation in V8 in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka incorrect WebAssembly stack manipulation...

chromium-browser: out of bounds read in skia

Iteration through non-finite points in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

Pidgin MXIT mxit_convert_markup_tx Information Leak Vulnerability(CVE-2016-2380)

DESCRIPTION An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out of bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead...

Pidgin MXIT Markup Command Denial of Service Vulnerability(CVE-2016-2365)

DESCRIPTION A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data t...

CVE-2017-15573

In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content...

Design/Logic Flaw

In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content...

DEBIAN-CVE-2017-15573

In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content...

CVE-2017-15573

In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content...

CVE-2017-15573

CVE-2017-15573 affects Redmine before 3.2.6 and 3.3.x before 3.3.3. The flaw is an XSS in wiki content caused by mishandling of markup in wiki pages. In practice, an attacker can inject scripts via wiki content (e.g., attachments with SVG) to execute in a victim's browser. The connected sources i...

CVE-2017-15573

In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content...