CVE-2017-15260

IrfanView version 4.44 32bit with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address may be used as a return value starting at PDF!xmlParserInputRead+0x0000000000129a59."...

The vulnerability of the “/com.sapportals.navigation.testComponent.NavigationRequestSniffer” component of the SAP NetWeaver software integration platform allows a hacker to inject any HTML tags into a page.

The vulnerability of the “/com.sapportals.navigation.testComponent.NavigationRequestSniffer” component of the SAP NetWeaver software integration platform exists due to the lack of measures taken to protect the structure of web pages. This vulnerability allows a malicious actor to inject arbitrary...

WordPress Link Modal Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress link modal. A remote attacker can exploit this vulnerability to inje...

STDU Viewer Buffer Overflow Vulnerability (CNVD-2017-30311)

STDU Viewer is a free file viewer that supports multiple formats. The program supports TIFF, PDF, DjVu, XPS and WWF formats. A buffer overflow vulnerability exists in STDU Viewer version 1.6.375. A local attacker can exploit this vulnerability to cause a denial of service with the help of a...

PT-2017-5751 · Joomla · Googlemaps Plugin

Name of the Vulnerable Software and Affected Versions: Googlemaps plugin for Joomla! versions prior to 3.1 Description: The issue allows remote attackers to conduct XML injection attacks. This is achieved by exploiting the url parameter in the plugin googlemap2 proxy.php file. Recommendations: Fo...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2017-32687)

Adobe ColdFusion is a dynamic Web server product that runs CFML which is a programming language for Web applications. Adobe ColdFusion fails to properly restrict references to XML external entities, allowing remote attackers to exploit vulnerabilities to submit special requests, obtain sensitive...

BSA-2017-429

Security Advisory ID : BSA-2017-429 Component : Struts REST Revision : 2.0: Interim A flaw was found in the Struts REST plugin when using an outdatedXStreamlibrary. An attacker could perform a denial of service attack using a malicious request with specially crafted XML payload. Affected Products...

Apache Struts2 S2-053 Remote Code Execution Vulnerability

Struts2 is the Apache Software Foundation is responsible for maintaining a MVC-based design pattern of the Web application framework for open source projects . Apache Struts2 suffers from a S2-053 remote code execution vulnerability that causes an attacker to remotely execute a code attack when a...

CVE-2017-1458

IBM QRadar Network Security 5.4 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128377...

Cross-site Scripting (XSS)

automattic/jetpack is vulnerable to cross-site scripting XSS attacks. The library does not parse LaTeX markup correctly, allowing a malicious user to inject and execute arbitrary webscript...

Automated Logic Corporation Multiple Device XML External Entity Vulnerability

Automated Logic provides a full range of building MEP control systems for a wide range of users, including central air conditioning automation, variable power distribution monitoring, water supply and drainage monitoring, lighting monitoring and elevator monitoring. The system has been widely use...

Adobe Digital Editions Security Bypass Vulnerability

Adobe Digital Editions DE is a set of e-book reading and management software of the United States Ordoby Adobe. Through the software can open, read and manage PDF, XML, Flash files. A security bypass vulnerability exists in Adobe DE 4.5.4 and earlier versions. A remote attacker can exploit this...

OpenJDK: insecure XML parsing in wsdlimport (JAX-WS, 8182054)

It was discovered that the wsdlimport tool in the JAX-WS component of OpenJDK did not use secure XML parser settings when parsing WSDL XML documents. A specially crafted WSDL document could cause wsdlimport to use an excessive amount of CPU and memory, open connections to other hosts, or leak...

Trend Micro Control Manager XML External Entity Vulnerability

Trend Micro Control Manager is the centralized management console for managing Trend Micro products and services. A security vulnerability in Trend Micro Control Manager's handling of XML external entities allows remote attackers to exploit the vulnerability by submitting specialized XML data,...

html_title - Unsupported - SA-CONTRIB-2017-059

The HTML Title module allows a limited set of HTML markup em, sub, sup, b, i, strong, cite, code, bdi, wbr to be used in node titles. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like ...

pidgin: Out-of-bounds write in purple_markup_unescape_entity triggered by invalid XML

An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process...

Joomla! cross-site scripting vulnerability (CNVD-2017-26330)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site scripting vulnerability exists in versions of Joomla! prior to 3.7.4. The vulnerability stems from the program's failure to adequately...

IBM Tivoli Endpoint ManagerXML External Entity Injection Vulnerability

IBM BigFix Platform is IBM's dynamic multi-technology platform that integrates message content drivers and management systems, of which Tivoli Endpoint Manager is the endpoint control software. An XML external entity injection vulnerability exists in Tivoli Endpoint Manager in IBM BigFix Platform...

Heap Overflow Vulnerability in WPS

WPS is an office software developed by Kingsoft Office Software. A heap overflow vulnerability exists in WPS text. The vulnerability is due to the program fails to validate the buffer length, an attacker can exploit the vulnerability by constructing a malformed XML file resulting in heap corrupti...

Schneider Electric Pelco Sarix/Spectra Cameras Cross-Site Scripting Vulnerability

Pelco Sarix/Spectra Cameras is a video camera. A cross-site scripting vulnerability exists in Schneider Electric Pelco Sarix/Spectra Cameras. When passed multiple parameters to multiple scripts, they are not properly filtered before being returned to the user. An attacker can exploit the...