OESA-2022-1658 libxml2 security update

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

[SECURITY] Fedora 34 Update: libxml2-2.9.14-1.fc34

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

CVE-2022-30045

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxmldecode performs incorrect memory handling while parsing crafted XML files, leading to a heap out-of-bounds read...

PT-2022-20429 · Jenkins · Jenkins Storable Configs Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Storable Configs Plugin versions 1.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to have Jenkins parse a local XML file, such as archived artifacts, that uses external entities for...

Ubuntu: Security Advisory (USN-5422-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5422-1: libxml2 vulnerabilities

Shinji Sato discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, and Ubuntu 16.04 ESM. CVE-2022-23308 It was...

Jenkins allows Deserialization of Untrusted Data via an XML File

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

GHSA-VC3X-72Q4-G3P5 XML External Entity Reference in jbpmmigration

It was discovered that the XmlUtils class in jbpmmigration performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXtern...

In libxml2 before 2.9.14 several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted multi-gigabyte XML file. Other software using libxml2's buffer functions for example libxslt through 1.1.35 is affected as well.

...

USN-5388-1: OpenJDK vulnerabilities

It was discovered that OpenJDK incorrectly limited memory when compiling a specially crafted XPath expression. An attacker could possibly use this issue to cause a denial of service. CVE-2022-21426 It was discovered that OpenJDK incorrectly handled converting certain object arguments into their...

xml-security: XPath Transform abuse allows for information disclosure

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...

Cross-Site Scripting (XSS)

microweber/microweber is vulnerable to stored cross-site scripting. The vulnerability exists in the getallowedfilesextensionsforupload function in Files.php because the xml files are not properly restricted which allows an attacker to inject and execute javascript...

GHSA-Q3X2-JVP3-WJ78 Unrestricted XML files leading to cross-site scripting in Microweber

Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack...

Unrestricted XML files leading to cross-site scripting in Microweber

Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack...

CVE-2022-0963

Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12...

Design/Logic Flaw

Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12...

CVE-2022-0963

Summary: Microweber prior to 1.2.12 has a stored XSS vulnerability caused by unrestricted XML file uploads. If an attacker can upload XML files, payloads may execute when users access the uploaded files. Affected software: Microweber CMS (GitHub microweber/microweber) versions before 1.2.12. Root...

Unrestricted XML Files Leads to Stored XSS

Description The web Application restricts upload files by blacklist extensions. It's not safe for the application to prevent the attack, there are many extension can cause an attack to user and web application. By uploading XML files, the users can perform an Stored XSS attack Proof of Concept 1...

EyesOfNetwork Cross-Site Scripting Vulnerability (CNVD-2022-34647)

EyesOfNetwork is an open source, free IT monitoring solution from the EyesOfNetwork community. The solution provides features such as business process configuration tools, generating pop-ups when events occur in the active queue, etc. EyesOfNetwork suffers from a cross-site scripting vulnerabilit...

[SECURITY] Fedora 35 Update: libxml2-2.9.13-1.fc35

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...