libxml2 安全漏洞

libxml2 is a GNOME open source library for parsing XML documents. It is written in C and can be called by many languages, such as C, C++, and XSH. A security vulnerability exists in libxml2 that stems from a null pointer dereference issue when processing XPath XML expressions, which could lead to...

SUSE CVE-2025-49795

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service...

Expired Pointer Dereference

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Expired Pointer Dereference due to a null pointer dereference while processing XPath XML expressions. An attacker can cause a crash and disrupt service availability by sending...

The vulnerability of Mozilla Firefox and Firefox ESR browsers, as well as the Thunderbird email client, stems from an operation that goes beyond the buffer boundaries in memory. This allows attackers to gain unauthorized access to protected information.

The vulnerabilities of Mozilla Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to the issue of executing operations beyond the buffer boundaries in memory during the processing of XPath expressions. Exploiting this vulnerability can allow an attacker to gain...

libxslt: Use-After-Free in libxslt numbers.c

A flaw was found in libxslt numbers.c. This vulnerability allows a use-after-free, potentially leading to memory corruption or code execution via nested XPath evaluations where an XPath context node can be modified but not restored...

The vulnerability of the GeoTools library, a software solution for managing and publishing geospatial data on the OSGeo GeoServer server, arises from improper code generation management. This vulnerability allows an attacker to execute arbitrary code.

The vulnerability of the GeoTools library, a software solution for managing and publishing geospatial data on the OSGeo GeoServer server, is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary code by...

The vulnerability of the ignoreDifferences configuration in the declarative delivery tool for GitOps for Kubernetes Argo CD allows a attacker to trigger a service failure.

The vulnerability of the ignoreDifferences configuration option in GitOps’ continuous delivery tool for Kubernetes Argo CD is related to an uncontrolled resource consumption when processing the jqPathExpressions parameter. Exploiting this vulnerability could allow a malicious actor to cause servi...

GeoTools Security Vulnerabilities

GeoTools is an open source Java library. Provides tools for geospatial data. A security vulnerability exists in GeoTools that stems from Remote Code Execution RCE that may occur if the application uses certain functions to evaluate XPath expressions provided by user input...

PT-2024-26971 · Geotools · Geotools

Name of the Vulnerable Software and Affected Versions: GeoTools versions prior to 31.2 GeoTools versions prior to 30.4 GeoTools versions prior to 29.6 Description: GeoTools is an open source Java library that provides tools for geospatial data. Remote Code Execution RCE is possible if an...

PT-2024-5350 · Jq +1 · Jq +1

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.10.8 Argo CD versions prior to 2.9.13 Argo CD versions prior to 2.8.17 Description: The issue is related to a Denial of Service DoS vulnerability via Out of Memory OOM using jq in ignoreDifferences. This...

GHSA-WRX5-RP7M-MM49 Withdrawn: CVE Rejected: JXPath vulnerable to remote code execution when interpreting untrusted XPath expressions

This advisory has been withdrawn due to the CVE being rejected. Original advisory text Those using JXPath to interpret untrusted XPath expressions may be vulnerable to a remote code execution attack. All JXPathContext class functions processing a XPath string are vulnerable except compile and...

CVE-2022-34812

A cross-site request forgery CSRF vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions...

CVE-2022-34813

A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions...

OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

CVE-2014-8119

The findifcfgpath function in netcf before 0.2.7 might allow attackers to cause a denial of service application crash via vectors involving augeas path expressions...

Design/Logic Flaw

The findifcfgpath function in netcf before 0.2.7 might allow attackers to cause a denial of service application crash via vectors involving augeas path expressions...

CVE-2014-8119

CVE-2014-8119 affects the netcf library, where the function find_ifcfg_path in netcf before 0.2.7 may allow a remote attacker to trigger a denial of service (application crash) via vectors involving augeas path expressions. This vulnerability has been acknowledged in multiple advisories across ve...

CVE-2014-8119

The findifcfgpath function in netcf before 0.2.7 might allow attackers to cause a denial of service application crash via vectors involving augeas path expressions...

SUSE SLED12 / SLES12 Security Update : augeas (SUSE-SU-2015:1249-1)

This update fixes an untrusted argument escaping problem CVE-2014-8119 : - new API - augescapename - which can be used to escape untrusted inputs before using them as part of path expressions - augmatch is changed to return properly escaped output Note that Tenable Network Security has extracted...