CVE-2023-26920

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...

DEBIAN-CVE-2023-26920

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...

CVE-2023-26920

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...

UBUNTU-CVE-2023-26920

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...

CVE-2023-26920

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...

CVE-2023-26920

CVE-2023-26920 affects the fast-xml-parser library (before 4.1.2). The issue is a Prototype Pollution flaw triggered by proto and can lead to remote code execution or denial of service, per IBM’s Cloud Pak for Data advisory (affecting 4.0.0–4.8.4; remediation to 4.8.5). NVD lists CVSSv3.1 base sc...

CVE-2023-26920

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...

fast-xml-parser security vulnerability

fast-xml-parser is an open source library from Natural Intelligence. It is used to quickly validate XML, parse XML and build XML without C/C++ based libraries and callbacks. A security vulnerability exists in versions of fast-xml-parser prior to 4.1.2, which stems from the presence of prototype...

1337-docs (>=1.0.10, <=1.0.16), 1pointfixed1 (1.3.5) +3703 more potentially affected by CVE-2023-26920 via fast-xml-parser (>=2.3.1, <=4.1.1)

fast-xml-parser NPM version =2.3.1, =1.0.10, =2.0.0, =1.0.0, =7.0.35, =2.0.0, =1.0.0, =3.0.0-beta.0, =3.0.0-beta.0, =2.73.2, =1.6.66, =0.5.0, =0.9.2 - @adamkac/gus-api-regon 1.0.2 and more Source cves: CVE-2023-26920 Source advisory: MEND:CVE-2023-26920...

CVE-2023-26920

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...

CVE-2023-26920: Improperly Controlled Modification of Object Prototype Attributes

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...

CVE-2023-26920

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...

USN-6542-1: TinyXML vulnerability

Wang Zhong discovered that TinyXML incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service...

Jenkins MATLAB Plugin missing permission checks

Jenkins MATLAB Plugin determines whether a user-specified directory on the Jenkins controller is the location of a MATLAB installation by parsing an XML file in that directory. MATLAB Plugin 2.11.0 and earlier does not perform permission checks in several HTTP endpoints implementing related form...

GHSA-CV4X-9F34-8RP9 Jenkins MATLAB Plugin missing permission checks

Jenkins MATLAB Plugin determines whether a user-specified directory on the Jenkins controller is the location of a MATLAB installation by parsing an XML file in that directory. MATLAB Plugin 2.11.0 and earlier does not perform permission checks in several HTTP endpoints implementing related form...

GHSA-9F5G-RGCR-8GRW Jenkins MATLAB Plugin cross-site request forgery vulnerability

Jenkins MATLAB Plugin determines whether a user-specified directory on the Jenkins controller is the location of a MATLAB installation by parsing an XML file in that directory. MATLAB Plugin 2.11.0 and earlier does not perform permission checks in several HTTP endpoints implementing related form...

CVE-2023-49656

Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-49656

Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-49656

Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-49656

The CVE-2023-49656 entry concerns the Jenkins MATLAB Plugin up to version 2.11.0, where the XML parser is not configured to prevent XML External Entity (XXE) attacks. The Red Hat, GitHub advisory, and Nessus entry corroborate that MATLAB Plugin 2.11.1 fixes the XXE vulnerability by configuring th...