3363 matches found
Fedora 39 : xerces-c (2023-817ecc703f)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-817ecc703f advisory. Update to 3.2.5, fixing CVE-2018-1311 and CVE-2023-37536 Tenable has extracted the preceding description block directly from the Fedora security...
Fedora 38 : xerces-c (2023-52ba628e03)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-52ba628e03 advisory. Update to 3.2.5, fixing CVE-2018-1311 and CVE-2023-37536 Tenable has extracted the preceding description block directly from the Fedora security...
(0Day) Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...
(0Day) Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The specific flaw exists within the doDocument method. Due to the improper restriction of XML...
(0Day) Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...
(0Day) Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...
(0Day) Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...
Jenkins Nexus Platform Plugin missing permission check
Jenkins Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. Additionally, the plugin does not...
DEBIAN-CVE-2023-34194
StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion and application exit via a crafted XML document with a '\0' located after whitespace...
DEBIAN-CVE-2023-26920
fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...
CVE-2023-26920
fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...
CVE-2023-26920
fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...
UBUNTU-CVE-2023-26920
fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...
CVE-2023-26920
fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...
CVE-2023-26920: Improperly Controlled Modification of Object Prototype Attributes
fast-xml-parser before 4.1.2 allows proto for Prototype Pollution...
1337-docs (>=1.0.10, <=1.0.16), 1pointfixed1 (1.3.5) +3708 more potentially affected by CVE-2023-26920 via fast-xml-parser (>=2.3.1, <=4.1.1)
fast-xml-parser NPM version =2.3.1, =1.0.10, =2.0.0, =1.0.0, =7.0.35, =2.0.0, =1.0.0, =3.0.0-beta.0, =3.0.0-beta.0, =2.73.2, =1.6.66, =0.5.0, =0.9.2 - @adamkac/gus-api-regon 1.0.2 and more Source cves: CVE-2023-26920 Source advisory: MEND:CVE-2023-26920...
CVE-2023-26920
CVE-2023-26920 affects the fast-xml-parser library (before 4.1.2). The issue is a Prototype Pollution flaw triggered by proto and can lead to remote code execution or denial of service, per IBM’s Cloud Pak for Data advisory (affecting 4.0.0–4.8.4; remediation to 4.8.5). NVD lists CVSSv3.1 base sc...
fast-xml-parser security vulnerability
fast-xml-parser is an open source library from Natural Intelligence. It is used to quickly validate XML, parse XML and build XML without C/C++ based libraries and callbacks. A security vulnerability exists in versions of fast-xml-parser prior to 4.1.2, which stems from the presence of prototype...
