The vulnerability of the Qualys Policy Compliance Connector Plugin lies in the improper restriction of XML links to external objects, which allows attackers to perform XXE attacks.

The vulnerability of the Qualys Policy Compliance Connector Plugin is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute XXE attacks using specially created XML code...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

The vulnerability of Google Chrome’s Skia graphic library allows a hacker to execute arbitrary code.

The vulnerability of Google Chrome’s Skia graphics library is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created HTML page...

Hibernate Validator Security Vulnerability

Hibernate Validator is a parameter validation framework from Hibernate. A security vulnerability exists in Hibernate Validator that stems from the fact that browsers may render invalid html...

Microsoft Edge’s vulnerability, related to security configuration errors, allows a hacker to bypass the sandbox protection mechanism and execute arbitrary code.

The vulnerability of Microsoft Edge relates to errors in security settings when processing HTML content. Exploiting this vulnerability allows a malicious actor to bypass sandbox protections and execute arbitrary code using a specially created file or web page...

ALPINE-CVE-2023-52426

libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...

Don't Muck My Markup <= 1.8 - Cross-Site Request Forgery

Description The Don't Muck My Markup plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform unauthorize...

SEW-EURODRIVE MOVITOOLS MotionStudio Code Issue Vulnerability

SEW-EURODRIVE MOVITOOLS MotionStudio is an engineering software from SEW-EURODRIVE. A security vulnerability exists in SEW-EURODRIVE MOVITOOLS MotionStudio version 6.5.0.2, which originates from the possibility of unrestricted file access when processing XML messages...

WordPress Don't Muck My Markup Plugin <= 1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Don't Muck My Markup Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-23510 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9934a7f8d741 Credits Nguyen Xuan Chien...

OpenText AppBuilder Code Issue Vulnerability

OpenText AppBuilder is an application from OpenText Canada. A security vulnerability exists in OpenText AppBuilder versions 21.2 through 23.2, which originates from XML External Entity Injection and allows server-side requests to forge, probe system files...

Exploit for Deserialization of Untrusted Data in Alibaba Fastjson

json.org CVE-2022-45688 true & false positive WTF ?? The p...

libxml2: NULL dereference in xmlSchemaFixupComplexType

A NULL pointer dereference vulnerability was found in libxml2. This issue occurs when parsing invalid XML schemas...

Improper restriction of XML external entity references (XXE) in Electronic Deliverables Creation Support Tool provided by Ministry of Defense

Overview Electronic Deliverables Creation Support Tool provided by Ministry of Defense improperly restricts XML external entity references XXE CWE-611. Toyama Taku of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

Electronic Delivery Check System Security Vulnerability

MAFF Electronic Delivery Check System is an electronic delivery check system from MAFF Japan. A security vulnerability exists in Electronic Delivery Check System Ver.14.0.001.002 and earlier versions, which stems from the handling of specially crafted XML files that may lead to the exposure of...

Ministry of Defense Electronic Deliverables Creation Support Tool Security Breach

Ministry of Defense Electronic Deliverables Creation Support Tool is an electronic deliverables creation support tool from Ministry of Defense, Japan. A security vulnerability exists in Ministry of Defense Electronic Deliverables Creation Support Tool Construction Edition version 1.0.4, Electroni...

The vulnerability of D-Link DCS-8300LHV2 Wi-Fi camera software allows a intruder to execute arbitrary code.

The vulnerability of D-Link DCS-8300LHV2 Wi-Fi cameras’ microprogramming software lies in the reading of data outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code during the syntactic analysis of XML elements...

NVIDIA DGX Security Vulnerability

NVIDIA DGX is a high-performance workstation for deep learning applications from NVIDIA. A security vulnerability exists in the NVIDIA DGX A100 Servers, which stems from an attacker could lead to an SMI markup vulnerability that could be used to execute arbitrary code at the SMM level...

OESA-2024-1017 tidy security update

When editing HTML it's easy to make mistakes. Wouldn't it be nice if there was a simple way to fix these mistakes automatically and tidy up sloppy editing into nicely laid out markup? Well now there is! Dave Raggett's HTML TIDY is a free utility for doing just that. It also works great on the...

Tiny Technologies TinyMCE Cross-Site Scripting Vulnerability

Tiny Technologies TinyMCE is a rich text editor from Tiny Technologies, USA. A cross-site scripting vulnerability exists in Tiny Technologies TinyMCE prior to version 5.9.0, which originates from an authenticated, remote attacker who can insert crafted HTML into the editor, resulting in the...

Mattermost Cross-site Scripting vulnerability

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client...