libxml2 Null Pointer Dereference Vulnerability

libxml2 is a software library for parsing XML documents. A null pointer dereference vulnerability exists in libxml2 versions prior to 2.9.11. An attacker can exploit this vulnerability to crash a program via a specially crafted XML document...

CVE-2021-27617

The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when uploaded and parsed by the application, could lead to...

Design/Logic Flaw

The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when uploaded and parsed by the application, could lead to...

XML External Entity (XXE)

oauth2-oidc-sdk is vulnerable to XML external entity XXE attacks.The parse function in SAML2AssertionValidator.java does not disable access to external entities by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server...

[ASA-202104-1] gitlab: multiple issues

Arch Linux Security Advisory ASA-202104-1 ========================================= Severity: Critical Date : 2021-04-29 CVE-ID : CVE-2021-22205 CVE-2021-28965 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1822 Summary ======= The package gitlab...

GO-2021-0060 Authentication bypass in github.com/russellhaering/gosaml2

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...

Sutou Kouhei rexml 安全漏洞

Sutou Kouhei rexml is a Sutou Kouhei open source application . Support for tree and stream document parsing . REXML security vulnerability , the vulnerability stems from parsing and serializing a carefully crafted XML document , may create a structure different from the original document with the...

ruby -- XML round-trip vulnerability in REXML

Juho Nurminen reports: When parsing and serializing a crafted XML document, REXML gem including the one bundled with Ruby can create a wrong XML document whose structure is different from the original one. The impact of this issue highly depends on context, but it may lead to a vulnerability in...

Cross site scripting

Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCUFILEINIT field of a Save Configuration XML document. The payload is triggered in the HTTP error response pages...

Regular Expression Denial Of Service (ReDoS)

is-svg is vulnerable to regular expression denial of service. An attacker is able to crash the application via a malicious SVG/XML document due to the usage of an insecure regular expression...

XML External Entity (XXE)

xmlgraphics-commons is vulnerable to XML external entity attacks. The external DTDs are not disabled by default and allows an attacker submit requests on behalf of the server via a malicious XML document...

VulnCheck KEV: CVE-2021-3122

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021...

PT-2021-19204

Name of the Vulnerable Software and Affected Versions NCR Command Center Agent version 16.3 Description The issue allows for the remote, unauthenticated execution of an arbitrary command as SYSTEM. This is achieved by submitting a runCommand parameter within an XML document sent to port 8089. The...

EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2020-2551)

According to the versions of the libreoffice packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not valida...

NewStart CGSL CORE 5.04 / MAIN 5.04 : qt Multiple Vulnerabilities (NS-SA-2020-0062)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has qt packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp. CVE-2018-19872 - An issue was...

Ubuntu: Security Advisory (USN-4619-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial of service

SAP NetWeaver Compare Systems versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service...

CVE-2020-4774

An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information su...

Security Bulletin: An XPath vulnerability may impact IBM Cúram Social Program Management (CVE-2020-4774)

Summary An XPath vulnerability may impact IBM Cúram Social Program Management, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information such as XML...

Debian DLA-2377-1 : qt4-x11 security update

Several vulnerabilities were fixed in qt4-x11, the legacy version of the Qt toolkit. CVE-2018-15518 Double-free or corruption in QXmlStreamReader during parsing of a specially crafted illegal XML document. CVE-2018-19869 A malformed SVG image causes a segmentation fault. CVE-2018-19870 A malforme...