CVE-2017-17761: Undefined Security Weakness

An issue was discovered on Ichano AtHome IP Camera devices. The device runs the "noodles" binary - a service on port 1300 that allows a remote LAN unauthenticated user to run arbitrary commands. This binary requires the "system" XML element for specifying the command. For example, a id command...

PT-2017-3364

Name of the Vulnerable Software and Affected Versions Ichano AtHome IP Camera devices affected versions not specified Description The issue concerns the "noodles" binary, a service running on port 1300, which allows a remote unauthenticated user to execute arbitrary commands. This is achieved by...

XML External Entity (XXE) Processing

zendframework/zend-json is susceptible to XML external entity XXE processing attacks. The attacks can be triggered because when loading an XML formatted string into a Simple XML Element object. The fromXml function in Json.php does not validate the XML formatted string properly...

CVE-2017-14482

Removed by vendor...

CVE-2017-14482

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe...

CVE-2017-9047

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlenbuf. If the content-type is...

CVE-2015-6031

Buffer overflow in the IGDstartelt function in igddescparse.c in the MiniUPnP client aka MiniUPnPc before 1.9.20150917 allows remote UPNP servers to cause a denial of service application crash and possibly execute arbitrary code via an "oversized" XML element name...

Buffer overflow

Buffer overflow in the IGDstartelt function in igddescparse.c in the MiniUPnP client aka MiniUPnPc before 1.9.20150917 allows remote UPNP servers to cause a denial of service application crash and possibly execute arbitrary code via an "oversized" XML element name...

CVE-2015-6031

Buffer overflow in the IGDstartelt function in igddescparse.c in the MiniUPnP client aka MiniUPnPc before 1.9.20150917 allows remote UPNP servers to cause a denial of service application crash and possibly execute arbitrary code via an "oversized" XML element name...

CVE-2015-6031

CVE-2015-6031 : A buffer overflow exists in MiniUPnP Client (MiniUPnPc) in the IGDstartelt function within igd_desc_parse.c. Versions before 1.9.20150917 are affected, allowing remote UPNP servers to crash the application and potentially execute arbitrary code via an oversized XML element name. S...

CVE-2015-6031

Buffer overflow in the IGDstartelt function in igddescparse.c in the MiniUPnP client aka MiniUPnPc before 1.9.20150917 allows remote UPNP servers to cause a denial of service application crash and possibly execute arbitrary code via an "oversized" XML element name...

CVE-2015-6031

Buffer overflow in the IGDstartelt function in igddescparse.c in the MiniUPnP client aka MiniUPnPc before 1.9.20150917 allows remote UPNP servers to cause a denial of service application crash and possibly execute arbitrary code via an "oversized" XML element name...

CVE-2015-2347

Cross-site scripting XSS vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML element in the req parameter to flexdata.action in 1 common/, 2 monitor/, or 3 psnpm/ or the 4 module XML element in the r...

PT-2015-5724

Name of the Vulnerable Software and Affected Versions Huawei SEQ Analyst versions prior to V200R002C03LG0001CP0022 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the command XML element in the req parameter to...

PT-2015-3581

Name of the Vulnerable Software and Affected Versions Hancom Office 2010 SE Description A buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a long string in the Text attribute in a TEXTART XML element in an HML file. Recommendations For Hancom Office 2010 SE, a...

CVE-2013-7103

McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the value attribute in a 1 TestFile XML element or the 2 hostname. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands...

Command injection

McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands by specifying them in the value attribute in a 1 Command or 2 Script XML element. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands...

PT-2013-6276

Name of the Vulnerable Software and Affected Versions McAfee Email Gateway version 7.6 Description The issue allows remote authenticated administrators to execute arbitrary commands. This can be achieved by specifying the commands in the value attribute within a Command or Script XML element...

CVE-2013-7104: Improper Neutralization of Special Elements used in an OS Command

McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands by specifying them in the value attribute in a 1 Command or 2 Script XML element. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands...

PT-2013-6275

Name of the Vulnerable Software and Affected Versions McAfee Email Gateway version 7.6 Description The issue allows remote authenticated administrators to execute arbitrary commands. This can be achieved by using shell metacharacters in the value attribute in a TestFile XML element or the hostnam...