CVE-2022-47966

CVE-2022-47966 POC for CVE-2022-47966 affecting the following ManageEngine products: Access Manager Plus Active Directory 360 ADAudit Plus ADManager Plus ADSelfService Plus Analytics Plus Application Control Plus Asset Explorer Browser Security Plus Device Control Plus Endpoint Central Endpoint...

xmlsec

XMLSec Library XMLSec library provides C based implementation for major XML Security standards: XML Signature Syntax and Processing XML Encryption Syntax and Processing Detailed information about supported features and algorithms can be found in the XMLDsig and the XMLEnc interoperability reports...

CVE-2021-21239

CVE-2021-21239 This is a poc script to explot the xmlsec vulnerability CVE-2021-21239 To use this script you can either build the docker image or you can provide an rsa key yourself and run it assuming you have xmlsec installed Vulnerability info:...

CLSA-2024-1733184025 TuxCare security update for org.apache.santuario:xmlsec (3 CVEs)

TuxCare rebuilt org.apache.santuario:xmlsec to address 3 CVEs. Fixed in 2.0.10.tuxcare...

CLSA-2024-1727136003 TuxCare security update for org.apache.santuario:xmlsec (1 CVE)

TuxCare rebuilt org.apache.santuario:xmlsec to address 1 CVE. Fixed in 2.3.1.tuxcare...

Exploit for Improper Verification of Cryptographic Signature in Pysaml2_Project Pysaml2

CVE-2021-21239 This is a poc script to explot the xmlsec vu...

EUVD-2017-1381

Malware in sbrugna...

xmlsec:xmlsec_fuzzer: Heap-buffer-overflow in xmlParsePubidLiteral

Project: https://github.com/lsh123/xmlsec.git Detailed Report: https://oss-fuzz.com/testcase?key=5538913756446720 Project: xmlsec Fuzzing Engine: afl Fuzz Target: xmlsecfuzzer Job Type: aflasanxmlsec Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x515000005ee4 Crash...

xmlsec:xmlsec_fuzzer: Heap-buffer-overflow in xmlParsePubidLiteral

Project: https://github.com/lsh123/xmlsec.git Detailed Report: https://oss-fuzz.com/testcase?key=5606523386789888 Project: xmlsec Fuzzing Engine: libFuzzer Fuzz Target: xmlsecfuzzer Job Type: libfuzzerasanxmlsec Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

Linux Distros Unpatched Vulnerability : CVE-2017-1000061

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or...

io.quarkiverse.xmlsec:quarkus-xmlsec (1.0.0), io.quarkiverse.xmlsec:quarkus-xmlsec-deployment (1.0.0) +506 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (2.5.3.final)

io.quarkus:quarkus-core MAVEN version 2.5.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - io.quarkiverse.xmlsec:quarkus-xmlsec 1.0.0 - io.quarkiverse.xmlsec:quarkus-xmlsec-deployment 1.0.0 -...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libxml2 vulnerabilities (USN-3739-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3739-1 advisory. Matias Brutti discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to expose...

ManageEngine ServiceDesk Plus < 14.0 Build 14004 RCE

A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus prior to 14.0 Build 14004 due to use of Apache xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and...

SUSE CVE-2016-9318

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity XXE attacks via a crafte...

SUSE CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain...

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain...

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain...

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain...

Remote code execution

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain...