4499 matches found
Business-Central code issue vulnerabilities
Business-central is a software package. A security vulnerability exists in Business-central that stems from the possibility of receiving an XML external entity injection attack...
UBUNTU-CVE-2022-31213
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file...
[SECURITY] Fedora 35 Update: golang-github-client9-plaintext-0-0.8.20190703git5bf47e7.fc35
Extract human languages in plain UTF-8 text from computer code and markup...
[SECURITY] Fedora 35 Update: golang-github-ajstarks-deck-0-0.12.20210114git30c9fc6.fc35
Deck is a library for clients to make scalable presentations, using a standard markup language. Clients read deck files into the Deck structure, and traverse the structure for display, publication, etc. Clients may be interactive or produce standard formats such as SVG or PDF...
SAP Business One code-related vulnerabilities
SAP Business One is a set of enterprise management software from SAP. The software includes functions such as financial management, operations management and human resource management. A denial-of-service vulnerability exists in SAP Business One version 10.0, which stems from improper input clean...
xml-security: XPath Transform abuse allows for information disclosure
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...
php: Special character breaks path in xml parsing
A flaw was found in php. The main cause of this vulnerability is improper input validation while parsing an Extensible Markup LanguageXML entity. A special character could allow an attacker to traverse directories. The highest threat from this vulnerability is confidentiality...
[SECURITY] Fedora 36 Update: golang-github-ajstarks-deck-0-0.12.20210114git30c9fc6.fc36
Deck is a library for clients to make scalable presentations, using a standard markup language. Clients read deck files into the Deck structure, and traverse the structure for display, publication, etc. Clients may be interactive or produce standard formats such as SVG or PDF...
WordPress plugin: Code issue involving the Import Any XML or CSV File function
WordPress is a blogging platform developed using the PHP language. WordPress Import any XML or CSV File plugin versions prior to 3.6.8 are vulnerable to arbitrary file uploads, which originate from accepting all zip files and automatically extracting the zip file without validating the extracted...
CVE-2022-34792
A cross-site request forgery CSRF vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML...
Teamcenter XML External Entity XXE
The vulnerability of the Teamcenter product lifecycle management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to perform XXE attacks remotely...
Nagios XI Cross-site Scripting Vulnerability
Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A cross-site scripting vulnerability exists in Nagios XI version 5.8.5 and prior versions. An attacker cou...
SilverStripe Framework Resource Management Error Vulnerability
silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.8.1. An attacker can exploit this vulnerability to conduct remote attacks via specially crafted XML documents...
CVE-2022-1028
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml ...
PT-2022-14242 · WordPress · Nested Pages
Name of the Vulnerable Software and Affected Versions: Nested Pages WordPress plugin versions prior to 3.1.21 Description: The issue allows high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltered html is disallowed, due to the plugin not escaping and sanitizing som...
org.jenkins-ci.main:jenkins-test-harness (1.553), org.jenkins-ci.main:jenkins-war (1.553) +2 more potentially affected by CVE-2022-34174 via org.jenkins-ci.main:jenkins-core (1.553)
org.jenkins-ci.main:jenkins-core MAVEN version 1.553 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.553 - org.jenkins-ci.main:jenkins-war 1.553 -...
org.jenkins-ci.main:jenkins-test-harness (1.551), org.jenkins-ci.main:jenkins-war (1.551) +4 more potentially affected by CVE-2022-34171 via org.jenkins-ci.main:jenkins-core (1.551)
org.jenkins-ci.main:jenkins-core MAVEN version 1.551 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.551 - org.jenkins-ci.main:jenkins-war 1.551 -...
WordPress Plugin WP-Filebase Download Manager Cross-Site Script Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Plugin WP-Filebase Download Manager version 3.4.4 contains a cross-site scripting...
Stored XSS vulnerability in junit
junit 1119.vaa5e9068dad7 and earlier does not escape descriptions of test results. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Run/Update permission. junit 1119.1121.vc43d0fc45561 applies the configured markup formatter to descriptions of test...