Apache Xalan-Java FEATURE_SECURE_PROCESSIN属性处理安全绕过漏洞

CVE ID:CVE-2014-0107 Apache Xalan-Java是一个使用Java和C++来实现XSLT库的项目。 Apache Xalan-Java处理部分输出属性时存在错误，允许攻击者利用漏洞绕过安全处理特性FEATURESECUREPROCESSING，可访问受限属性或加载任意受限类。 0 Apache Xalan-Java 2.7.0 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞： https://issues.apache.org/jira/browse/XALANJ-2435...

Debian Security Advisory DSA 2886-1 (libxalan2-java - security update)

Nicolas Gregoire discovered several vulnerabilities in libxalan2-java, a Java library for XSLT processing. Crafted XSLT programs could access system properties or load arbitrary classes, resulting in information disclosure and, potentially, arbitrary code execution. OpenVAS Vulnerability Test $Id...

Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2013-0770)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0770 advisory. 1:1.6.0.0-1.61.1.11.11 - added and applied temporally patch10 fixToFontSecurityFix.patch. - fixing regression in fonts introduced by one security...

java-1.6.0-openjdk security update

1:1.6.0.0-1.61.1.11.11 - added and applied temporally patch10 fixToFontSecurityFix.patch. - fixing regression in fonts introduced by one security patch. - Resolves: rhbz950386 1:1.6.0.0-1.60.1.11.11 - added and applied temporally one more patch to xalan/xerces privileges - patch9...

Liferay XSL - Command Execution (Metasploit)

Liferay XSL - Command Execution Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

Liferay XSL Command Execution

Exploit for windows platform in category remote exploits $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Fedora Update for xml-security-c FEDORA-2011-9501

Check for the Version of xml-security-c OpenVAS Vulnerability Test Fedora Update for xml-security-c FEDORA-2011-9501 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

Fedora Update for xml-security-c FEDORA-2011-9494

Check for the Version of xml-security-c OpenVAS Vulnerability Test Fedora Update for xml-security-c FEDORA-2011-9494 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

[SECURITY] Fedora 15 Update: xml-security-c-1.5.1-5.fc15

The xml-security-c library is a C++ implementation of the XML Digital Signa ture specification. The library makes use of the Apache XML project's Xerces-C X ML Parser and Xalan-C XSLT processor. The latter is used for processing XPath and XSLT transforms...

[SECURITY] Fedora 14 Update: xml-security-c-1.5.1-4.fc14

The xml-security-c library is a C++ implementation of the XML Digital Signa ture specification. The library makes use of the Apache XML project's Xerces-C X ML Parser and Xalan-C XSLT processor. The latter is used for processing XPath and XSLT transforms...

Fedora Core 11 FEDORA-2009-8157 (xml-security-c)

The remote host is missing an update to xml-security-c announced via advisory FEDORA-2009-8157. OpenVAS Vulnerability Test $Id: fcore20098157.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-8157 xml-security-c Authors: Thomas Reinke Copyright:...

Fedora Core 10 FEDORA-2009-8121 (xml-security-c)

The remote host is missing an update to xml-security-c announced via advisory FEDORA-2009-8121. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright ...

Fedora Core 11 FEDORA-2009-8157 (xml-security-c)

The remote host is missing an update to xml-security-c announced via advisory FEDORA-2009-8157. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright ...

[SECURITY] Fedora 11 Update: xml-security-c-1.5.1-1.fc11

The xml-security-c library is a C++ implementation of the XML Digital Signa ture specification. The library makes use of the Apache XML project's Xerces-C X ML Parser and Xalan-C XSLT processor. The latter is used for processing XPath and XSLT transforms...

[SECURITY] Fedora 10 Update: xml-security-c-1.5.1-1.fc10

The xml-security-c library is a C++ implementation of the XML Digital Signa ture specification. The library makes use of the Apache XML project's Xerces-C X ML Parser and Xalan-C XSLT processor. The latter is used for processing XPath and XSLT transforms...

Code injection

Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Java code via a crafted XSLT stylesheet with "extension elements and extension functions" that trigger code execution by Xalan-Java, as demonstrated using xalan://java.lang.Runtime...

CVE-2009-1088

Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Java code via a crafted XSLT stylesheet with "extension elements and extension functions" that trigger code execution by Xalan-Java, as demonstrated using xalan://java.lang.Runtime...

Command Execution in Hannon Hill Cascade Server

Emory University UTS Security Advisory EMORY-2009-01 Topic: Command Execution in Hannon Hill Cascade Server Original release date: March 19, 2009 SUMMARY ======= Hannon Hill's Cascade Server product is vulnerable to a command execution vulnerability. An attacker with access to an unprivileged...

Hannon Hill Cascade Server Command Execution Vulnerability (post auth)

Exploit for cgi platform in category web applications ====================================================================== Hannon Hill Cascade Server Command Execution Vulnerability post auth ====================================================================== Emory University UTS Security...

Hannon Hill Cascade Server - (Authenticated) Command Execution

Emory University UTS Security Advisory EMORY-2009-01 Topic: Command Execution in Hannon Hill Cascade Server Original release date: March 19, 2009 SUMMARY ======= Hannon Hill's Cascade Server product is vulnerable to a command execution vulnerability. An attacker with access to an unprivileged...