Design/Logic Flaw

yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet...

CVE-2020-25216

yWorks yEd Desktop before 3.20.1 is affected by a code execution vulnerability triggered by an XSL Transformation when processing an XML file with a custom stylesheet. The root cause is an XSLT processing path that allows arbitrary code execution in the context of the affected application. Affect...

PT-2020-16023 · Yworks · Yed Desktop

Name of the Vulnerable Software and Affected Versions: yWorks yEd Desktop versions prior to 3.20.1 Description: The issue allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet. Recommendations: For versions prior to 3.20.1, update to versio...

CVE-2020-25216

yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet...

Palo Alto Networks PAN-OS Buffer Overflow Vulnerability (CNVD-2020-31586)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A security vulnerability exists in the XSLT processing logic in Palo Alto Networks PAN-OS. An attacker could exploit this vulnerability to upload and execute malicious files with...

Erroneous Stylesheet Caching

SeaMonkey is vulnerable to erroneous stylesheet caching. The CSSLoaderImpl::DoSheetComplete function in layout/style/nsCSSLoader.cpp changes the case of certain strings in a stylesheet before adding this stylesheet to the XUL cache, which might allow remote attackers to modify the browser's font...

UBUNTU-CVE-2020-10960

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...

CVE-2019-17020

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...

The vulnerability of the XSLT (Extensible Stylesheet Language Transformations) implementation of the Apache Syncope system allows a attacker to read the file, write to the file, or execute arbitrary code.

The vulnerability of the XSLT Extensible Stylesheet Language Transformations implementation of the Apache Syncope system’s digital identifier management mechanism is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to read files, write files, or...

CVE-2019-17020

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...

Design/Logic Flaw

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...

CVE-2019-17020

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...

CVE-2019-17020

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...

CVE-2019-17020

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...

CVE-2019-17020

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...

CVE-2019-17020: Improper Restriction of XML External Entity Reference

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...

Unspecified Vulnerability in Apache Struts2

Apache Struts is the United States Apache Apache Software Foundation, an open source project , is a set of open source MVC framework for creating enterprise-class Java Web applications , mainly provides two versions of the framework products , Struts 1 and Struts 2. There is a security...

PT-2019-4867

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 72 Description The issue is related to a security policy error that does not apply to the contents of an XSL stylesheet when an XML file is served with a Content Security Policy and includes an XSL stylesheet. This...

Multiple Apple Products libxslt Component Memory Corruption Vulnerability

Apple watchOS and others are products of Apple Inc.Apple watchOS is a smartwatch operating system.Apple iCloud for Windows is a cloud service based on the Windows platform. The product supports storage of music, photos, apps, contacts, etc. Apple macOS Catalina is a specialized operating system...

[SECURITY] Fedora 31 Update: libxslt-1.1.33-4.fc31

This C library allows to transform XML files into other XML files or HTML, text, ... using the standard XSLT stylesheet transformation mechanism. To use it you need to have a version of libxml2 =3D 2.6.27 installed. The xsltproc command is a command line interface to the XSLT eng ine...