DEBIAN-CVE-2019-5881

Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

jackson-mapper-asl XML External Entity Vulnerability

jackson-mapper-asl is a data mapping package built on the Jackson JSON processor. An XML external entity vulnerability exists in version 1.9.x of jackson-mapper-asl. No detailed vulnerability details are provided at this time...

The vulnerability of the Enterprise Resource Management System “Galaktika ERP” allows a hacker to initiate requests for resources on behalf of the server.

The vulnerability of the .res components of the Enterprise Resource Management System “Galaktika ERP” is related to the functionality of importing XML configurations. Exploiting this vulnerability allows a malicious actor to initiate requests to any resource on behalf of the server by performing...

infinispan: deserialization of data in XML and JSON transcoders

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possibl...

XML Entity Injection Vulnerability in Panmicro E-cology

Panmicro Collaborative Management Application Platform e-cology is a collaborative business platform with enterprise information portal, knowledge management, data center, workflow management, human resource management, customer and partner management, project management, financial management, an...

Cryptocat Input Validation Error Vulnerability (CNVD-2019-40145)

Cryptocat is an open source online cryptographic chat application. A security vulnerability exists in versions of Cryptocat prior to 2.0.22. An attacker can exploit this vulnerability to cause the application to generate invalid HTML code...

CVE-2019-13496

One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defender product, and replacing a failed SAML response with a successful SAML response...

ClipSoft REXPERT XML Injection Vulnerability

ClipSoft REXPERT is a report generation program from ClipSoft Korea. An injection vulnerability exists in ClipSoft REXPERT XML. An attacker can exploit this vulnerability to create and execute arbitrary files via the report printing function...

chromium-browser: Chrome web store origin needs to be isolated

Insufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page...

The vulnerability of the syntactic analyzer of the Microsoft XML Core Services for Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the syntactic analyzer of the Microsoft XML Core Services for Windows operating systems is related to errors in processing user input. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by having the user open a specially created web page...

Mozilla: Incorrect HTML parsing results in XSS bypass technique

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...

PT-2019-5892 · Reportlab +4 · Reportlab +4

Name of the Vulnerable Software and Affected Versions: ReportLab versions prior to 3.5.27 Description: The issue is related to the toColorevalarg function in the ReportLab library, which is connected to an error in processing XML documents. This can be exploited by a remote attacker to gain acces...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to compromise data integrity, gain unauthorized access to protected information, and cause service failures.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine arises from an operation that occurs outside the buffer in memory. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service failures through a...

The vulnerability of Google Chrome, related to errors in inheriting security policies for new documents, allows a perpetrator to compromise the integrity of data.

The vulnerability of Google Chrome is related to errors in inheriting security policies for new documents. Exploiting this vulnerability can allow a malicious actor to compromise data integrity through a specially created HTML page...

The vulnerability of the XSLT implementation for converting XML documents in Firefox browsers allows attackers to trigger a service failure or execute arbitrary code.

The vulnerability of the XSLT transformation language for XML documents in Firefox browsers arises due to incorrect checking of number formatting boundaries during formatting operations. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

CVE-2008-5646

Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain wiki markup."...

PT-2019-17122 · Ibm · Ibm Security Directory Server

Name of the Vulnerable Software and Affected Versions: IBM Security Directory Server version 6.4.0 Description: The issue allows attackers to modify the syntax, content, or commands of the XML before it is processed by an end system, due to the improper neutralization of special elements used in...

The vulnerability of the libexpat function in the C language library, which is used for performing XML parsing, allows an attacker to cause a denial-of-service attack.

The vulnerability of the libexpat function in the C language library for performing XML parsing in Expat involves the XML parser itself, which consumes a large amount of memory and CPU resources. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

The vulnerability of the SAML broker component of the Keycloak identity and access management software allows a malicious actor to gain unauthorized access to the system.

The vulnerability of the SAML broker component in the Keycloak identity and access management software is related to incorrect authentication processes. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the system by modifying the SAML...

USN-4132-2 expat vulnerability

USN-4132-1 fixed a vulnerability in Expat. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive...