WordPress User List Table Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation. WordPress fails to adequately filter user-submitted input, allowing remote attackers to exploit vulnerabilities to inject malicious scripts or HTML code that can capture sensitive...

USN-2780-1 miniupnpc vulnerability

Aleksandar Nikolic discovered a buffer overflow vulnerability in the XML parser functionality of the MiniUPnP library. A remote attacker could use this to cause a denial of service application crash or possibly execute arbitrary code with privileges of the user running an application that uses th...

The vulnerability of the SAP NetWeaver software integration platform allows a perpetrator to trigger a service failure or induce the system to access external resources.

The vulnerability of the SAP NetWeaver software integration platform exists due to the lack of access restrictions on external objects contained in the links within the processed XML files. Exploiting this vulnerability can allow a malicious actor to cause service failures or induce the system to...

The vulnerability of Microsoft Lync Server’s messaging server allows a hacker to inject arbitrary web or HTML code.

The vulnerability of Microsoft Lync Server’s messaging server exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code through a specially crafted URL...

Unspecified Vulnerability in Apple OS X Server Wiki Server XML

Apple Mac OS X is a commercial operating system. Multiple unspecified vulnerabilities exist in Apple OS X Server Wiki Server processing XML. A detailed vulnerability description is not currently available...

Vulnerabilities of iOS and Mac OS X operating systems, which allow attackers to gain access to protected information or cause service failures

The vulnerability of the libxml2 component in iOS and Mac OS X operating systems arises due to buffer overflows. Exploiting this vulnerability can allow an attacker to gain access to sensitive information or cause service failures by using a specially crafted XML document...

[SECURITY] [DLA 290-2] opensaml2 security update

Package : opensaml2 Version : 2.3-2+squeeze2 CVE ID : CVE-2015-0851 It was discovered that opensaml2, a Security Assertion Markup Language library, needed to be rebuilt against a fixed version of the xmltooling package due to its use of macros vulnerable to CVE-2015-0851 as fixed in the DSA 3321-...

[SECURITY] Fedora 22 Update: opensaml-java-2.5.3-9.fc22

OpenSAML is a set of open source C++ & Java libraries meant to support developers working with the Security Assertion Markup Language SAML. OpenSAML 2, the current version, supports SAML 1.0, 1.1, and 2.0...

[SECURITY] Fedora 21 Update: opensaml-java-2.5.3-9.fc21

OpenSAML is a set of open source C++ & Java libraries meant to support developers working with the Security Assertion Markup Language SAML. OpenSAML 2, the current version, supports SAML 1.0, 1.1, and 2.0...

DEBIAN-CVE-2015-1283

Multiple integer overflows in the XMLGetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted XML data, a related...

Z-BLOG Blind-XXE Arbitrary File Read Vulnerability

Z-Blog is developed by RainbowSoft Studio a Blog program based on the Asp platform . Z-Blog has an arbitrary file read vulnerability. /zbsystem/xml-rpc/index.php directly call simpleloadstring parsing XML, resulting in XML entity injection, an attacker can read system files using the vulnerabilit...

SAP Mobile Platform XML External Entity Information Disclosure Vulnerability

SAP Mobile Platform SMP is a mobile application development platform from SAP. The platform is used to build packaged and customized development applications for any device. A security vulnerability exists in the SAP Mobile Platform XML external entity. This vulnerability could be exploited by an...

Apache Jackrabbit XML External Entity Input Vulnerability

Apache Jackrabbit is a full compliance with the Java API version of the content storage specification JCR implementation . An XML external entity injection vulnerability exists in Apache Jackrabbit, which allows remote attackers to exploit the vulnerability by submitting a special XML request to...

IBM License Metric Tool Directory Traversal Vulnerability

The IBM License Metric Tool is a free tool from IBM USA that helps IBM Passport Advantage Software Upgrade and Support Services customers determine their Processor Value Unit PVU license requirements. A directory traversal vulnerability exists in the IBM License Metric Tool and Tivoli Asset...

Drupal Crumbs Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Crumbs, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information ...

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

RESTeasy: External entities expanded by DocumentProvider

It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessibl...

JAX-RS: Information disclosure via XML eXternal Entity (XXE)

It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity XXE attacks on RESTEasy applications accepting XML input...

XStream: remote code execution due to insecure XML deserialization

It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream...

Mozilla Thunderbird Linux Gstreamer Plugin H.264 Video Processing Buffer Overflow Vulnerability

Mozilla Thunderbird is a mail tool adapted from the mail widget of the Mozilla browser. The Linux Gstreamer plugin used by Mozilla Thunderbird to handle H.264 suffers from a buffer overflow vulnerability that allows remote attackers to exploit the vulnerability by submitting a special HTML messag...