Improper Restriction of XML External Entity Reference in Castor

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted XML document...

GHSA-JWWR-FJGH-CV2X Improper Restriction of XML External Entity Reference in Castor

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted XML document...

CVE-2022-24449

Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document...

Server side request forgery (ssrf)

Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document...

CVE-2022-24449: Improper Restriction of XML External Entity Reference

Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document...

XML External Entity (XXE)

detekt-core is vulnerable to XML external entity attacks. The vulnerability exists in the read function in BaselineFormat.kt due to improper validation which allows an attacker to submit a malicious XML document...

PHP php_wddx_push_element DoS

The vulnerability of the phpwddxpushelement function ext/wddx/wddx.c in the PHP programming language is caused by buffer overflows. Exploiting this vulnerability can allow an attacker to cause a service failure due to an incorrect logical element in an XML document...

EUVD-2022-32667

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS...

DEBIAN-CVE-2021-44960

In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function...

SVG++ code issues and vulnerabilities

SVG++ Ssvgpp is a C++ framework. The framework includes an SVG syntax parser, adapters for handling parsed data, and various utilities. SVGPP A security vulnerability exists in SVG++ that stems from the XMLDocument::getRoot function in the renderDocument function incorrectly handling the...

Authentication Bypass in github.com/russellhaering/gosaml2

Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users...

GLSA-202107-05 : libxml2: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202107-05 libxml2: Multiple vulnerabilities Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to process a...

CVE-2021-46163

Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem...

Design/Logic Flaw

Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem...

CVE-2021-46163

Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem...

CVE-2021-46163

Kentico Xperience 13.0.44 is affected by a cross-site scripting (XSS) vulnerability in the Media Libraries subsystem. The root cause is that the media subsystem does not validate input data, allowing crafted XML documents to inject script executed on the client. Impact is client-side code executi...

CVE-2021-46163

Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem...

PT-2022-12595

Name of the Vulnerable Software and Affected Versions Kentico Xperience version 13.0.44 Description The issue allows for cross-site scripting XSS via an XML document to the Media Libraries subsystem. Recommendations For Kentico Xperience version 13.0.44, consider restricting access to the Media...

CVE-2021-46163: Improper Neutralization of Input During Web Page Generation

Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem...

Jenkins Report Info XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Jenkins Report Info. Authentication is required to exploit this vulnerability. The specific flaw exists within the PMD class. Due to the improper restriction of XML External Entity XXE...