Crewjam Saml Security Vulnerability

Crewjam Saml is a Go-based implementation of the Crewjam Personal Developer's codebase that interacts with Saml format files. crewjam saml suffers from a security vulnerability that stems from DescriptionA signature verification, a flaw that allows an attacker to bypass SAML authentication. The...

AZL-78900 CVE-2020-29509 affecting package golang 1.25.7-1

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

Google Go encoding security vulnerability

Google Go encoding is a code library from Google Inc. that provides multiple forms of encoding for data based on the Go language. A security vulnerability exists in the Go encoding/xml package that stems from not properly preserving the semantics of element namespace prefixes, which can be...

OpenAsset Digital Asset Management software 跨站脚本漏洞

Openasset is a digital asset management software for the website building industry from Openasset UK. The OpenAsset Digital Asset Management software product suffers from an XSS injection vulnerability that could allow a remote attacker to inject arbitrary JavaScript or HTML for later rendering b...

PHPOffice PhpSpreadsheet Cross-Site Scripting Vulnerability

PHPOffice PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. A security vulnerability exists in version 0.0.0 of phpoffice/phpspreadsheet, which originates from the affected package phpoffice phpspreadsheet from 0.0.0. The library is susceptible to XSS attacks when creatin...

SAP BusinessObjects BI Platform 产品安全漏洞

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product features report generation, analytics and data visualization. An XML external entity injection vulnerability exists in SAP BusinessObjects...

The vulnerability of the KTS “Lighthouse” web interface, which stems from the lack of measures to sanitize input data, allows a perpetrator to inject any desired web script or HTML code.

The vulnerability of the KTS “Lighthouse” web interface is related to the lack of measures to sanitize input data. Exploiting this vulnerability allows a remote attacker to inject arbitrary web scripts or HTML code...

HTML Injection

Google Chrome is vulnerable to HTML injection. A remote attacker could perform a Dangling Markup Injection attack via a crafted HTML page due to the affected DevTools component...

DEBIAN-CVE-2020-25649

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity...

PT-2020-5805 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.12.0 through 1.35.0 Description: The issue is related to insufficient protection measures in the BlockLogFormatter.php component of MediaWiki, allowing a remote attacker to compromise data integrity. The problem lies in t...

PT-2020-8128

Name of the Vulnerable Software and Affected Versions: Crafter Studio versions prior to 3.0.1 Description: An unauthenticated attacker can create a site with specially crafted XML, allowing the retrieval of OS files out-of-band. This issue affects Crafter Studio, enabling attackers to access...

Petl Security Vulnerabilities

Petl is a Pypi package from the Petl Personal Developer that allows access to formatted read and write from files, databases, or other source data. A security vulnerability exists in petl versions prior to 1.68, which stems from allowing entities in XML documents to be parsed in certain...

Terraform Enterprise Allowed Local Account Creation Bypassing SSO

Summary HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. This vulnerability, CVE-2020-15511, was fixed in v202007-1. Background Terraform Enterprise allowed single sign-on to be enabled vi...

TYPO3 Input Validation Error Vulnerability (CNVD-2020-65162)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. TYPO3 suffers from a security vulnerability that stems from insufficient validation of user-supplied XML input in RSS widgets, which can be exploited by a remote user to pass specially...

Cross-site Scripting (XSS)

Overview markdown-it-prism is a The plugin will insert the necessary markup into all code blocks. Include one of Prism’s stylesheets in your HTML to get highlighted code. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible to insert malicious JavaScript as...

CVE-2020-27193

A cross-site scripting XSS vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs...

The vulnerability of Google Chrome’s browser, related to writing beyond the memory buffer, allows attackers to bypass the sandboxing protection mechanism.

The vulnerability of Google Chrome relates to the writing beyond the memory buffer. Exploiting this vulnerability allows a malicious actor to bypass the sandboxing mechanism by using a specially crafted HTML page...

CloudBees Jenkins Subversion Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A code issue vulnerability...

Cisco SD-WAN vManage XML External Entity Injection Vulnerability (CNVD-2020-66211)

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. An XML external entity injection vulnerability exists in the web UI of Cisco SD-WAN vManage 20.1.12 and earlier. The vulnerability stems from improper handling of XML External Entity XXE...

expat: large number of colons in input makes parser consume high amount of resources, leading to DoS

It was discovered that the "setElementTypePrefix" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of service...