37 matches found
librsvg2 -- multiple vulnerabilities
Librsvg2 developers reports: Backport the following fixes from 2.46.x: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document. This is to mitigate malicious SVGs which try to consume all memory, and those which try to consume an...
CVE-2019-4539
IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. IBM X-Force ID: 165812...
Access Restriction Bypass
JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...
Cross site scripting
Cross-site scripting XSS vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML element in the req parameter to flexdata.action in 1 common/, 2 monitor/, or 3 psnpm/ or the 4 module XML element in the r...
MS Internet Explorer <= 6.x (IMG / XML elements) Denial of Service
No description provided by source. !-- Discovered by Inge Henriksen [email protected] http://ingehenriksen.blogspot.com/ -- table tr tdIMG align=leftX X X?xml:namespace prefix=v v:X style=HEIGHT:1/td /tr /table milw0rm.com 2006-01-18...
Code injection
net/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service resource consumption via a crafted XMPP stream, aka an "xmppbomb" attack...
Code injection
Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service resource consumption via a crafted XMPP stream, aka an "xmppbomb" attack...
CVE-2014-2744
plugins/modcompression.lua in 1 Prosody before 0.9.4 and 2 Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service resource consumption via compressed XML elements in an XMPP stream, aka an...
CVE-2014-2744
plugins/modcompression.lua in 1 Prosody before 0.9.4 and 2 Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service resource consumption via compressed XML elements in an XMPP stream, aka an...
Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update
JBoss Enterprise Application Platform 6.0.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring...
Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update
Updated JBoss Enterprise Application Platform 6.0.1 packages that fix multiple security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...
Apple Quicktime TeXML sampleData Element Parsing Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X...
Apple Quicktime TeXML transform Attribute Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X...
Microsoft Office Excel XLSX File Parsing Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Excel. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists in the decompression of XLSX files. The XL...
MS Internet Explorer <= 6.x (IMG / XML elements) Denial of Service
No description provided by source. !-- Discovered by Inge Henriksen [email protected] http://ingehenriksen.blogspot.com/ -- table tr tdIMG align=leftX X X?xml:namespace prefix=v v:X style="HEIGHT:1"/td /tr /table...
Microsoft Internet Explorer 6.x - IMG / XML elements Denial of Service
X X X milw0rm.com 2006-01-18...
CVE-2003-0718: Undefined Security Weakness
The WebDAV Message Handler for Internet Information Services IIS 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service memory and CPU exhaustion, application crash via a PROPFIND request with an XML message containing XML elements with a large number of attributes...