1106 matches found
CVE-2024-23913
Use of Out-of-range Pointer Offset vulnerability in Merge DICOM Toolkit C/C++ on Windows. When deprecated MCXMLToMessage function is used to read a malformed DICOM XML file, it might result in memory access violation...
MGASA-2024-0155 Updated mediawiki packages fix security vulnerabilities
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator...
CentOS 9 : libxml2-2.9.13-5.el9
The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libxml2-2.9.13-5.el9 build changelog. - Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerabili...
WP Smart Import : Import any XML File to WordPress < 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting
Description The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CentOS 9 : libxml2-2.9.13-2.el9
The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libxml2-2.9.13-2.el9 build changelog. - In libxml2 before 2.9.14, several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer don't check for integer overflows. This can resu...
USN-6305-2 php7.0, php7.2, php7.4 vulnerabilities
USN-6305-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to...
CVE-2024-24743
SAP NetWeaver AS Java CAF - Guided Procedures - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so...
CVE-2024-24743 XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)
SAP NetWeaver AS Java CAF - Guided Procedures - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so...
CVE-2024-24743 XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)
SAP NetWeaver AS Java CAF - Guided Procedures - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so...
RHEL 8 : libxml2 (RHSA-2023:7544)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7544 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: crafted xml can cause...
CVE-2024-21765
Electronic Delivery Check System Doboku Ver.18.1.0 and earlier, Electronic Delivery Check System Dentsu Ver.12.1.0 and earlier, Electronic Delivery Check System Kikai Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML...
Xxe
Electronic Delivery Check System Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XML file,...
CISA Issues Emergency Directive to Federal Agencies on Ivanti Zero-Day Exploits
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday issued an emergency directive urging Federal Civilian Executive Branch FCEB agencies to implement mitigations against two actively exploited zero-day flaws in Ivanti Connect Secure ICS and Ivanti Policy Secure IPS products...
AlmaLinux 8 : libxml2 (ALSA-2024:0119)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:0119 advisory. - Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerability allows...
libxml2: crafted xml can cause global buffer overflow
A flaw was found in Libxml2, where it contains a global buffer overflow via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a denial of service DoS by supplying a crafted XML file...
RHEL 8 : libxml2 (RHSA-2024:0119)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0119 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: crafted xml can cause...
Oracle Linux 8 : libxml2 (ELSA-2024-0119)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-0119 advisory. - Fix CVE-2023-39615 RHEL-5179 - Fix CVE-2023-28484 2186692 Tenable has extracted the preceding description block directly from the Oracle Linux security...
Cross Site Scripting (XSS)
Cacti is vulnerable to Cross Site Scripting XSS. The vulnerability is due to missing XML file name sanitization during template upload. If the template fails the checks, the raw filename is displayed as a JavaScript pop-up prompt. An attacker can upload a XML filename including a JavaScript...
PT-2023-31029 · Unknown +1 · Phpsysinfo +1
Name of the Vulnerable Software and Affected Versions: Phpsysinfo version 3.4.3 Description: A Cross Site Request Forgery CSRF issue allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. The functionality is disabled by default in Phpsysinfo 3.4.3, but...