140 matches found
NetSec-CVE-2023-4357
ネットワークセキュリティプロジェクト — CVE-2023-4357 概要 このプロジェクトは、ネットワークセキュリティコースの最終プロジェクトです。 このプロジェクトは、Google Chrome 116.0.5845.96 より前のバージョンに影響する脆弱性 CVE-2023-4357 に焦点を当てています。この脆弱性は XML/XSLT の処理に関連しており、悪意のあるドキュメントが意図されたファイルアクセス制限を回避できる可能性があります。 再現 私は仮想マシン上で古いバージョンの Google Chrome を使用してこの脆弱性を再現し、XML...
CVE-2026-82525 Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing
Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...
CVE-2026-82525
Exterro FTK Imager before 8.3 is affected by an XML External Entity (XXE) injection vulnerability in the processing of Report.xml within UFDR ZIP evidence items. The root cause is the XML parser resolving file:// external entity references and executing msxsl:script within attacker-controlled XSL...
CVE-2026-82525 Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing
Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...
CVE-2026-4813
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...
EUVD-2026-69014
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...
CVE-2026-4813 Code injection in the Lutece Core
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...
CVE-2026-4813 Code injection in the Lutece Core
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...
CVE-2026-4813
Lutece Core versions up to 7.1.7 are affected by a code injection vulnerability in the XSL export management module . The root cause is that the XML/XSLT processing configuration does not enable FEATURE_SECURE_PROCESSING , permitting Java extension functions to execute from malicious XSL styleshe...
CVE-2026-4813: Improper Control of Generation of Code
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...
PT-2026-84142
Name of the Vulnerable Software and Affected Versions Lutece Core versions prior to 7.1.8 Description An issue in the XSL export management module allows authenticated administrators to execute arbitrary code on the server. The XML/XSLT processing configuration fails to enable secure processing...
Linux Distros Unpatched Vulnerability : CVE-2025-71406
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.18.4 bundles a vulnerable version of libxslt prior to 1.1.43 that contains two use- after-free vulnerabilities: CVE-2025-24855 use-after-free ...
CVE-2025-71406
A flaw was found in Nokogiri, which bundles a vulnerable version of libxslt. This vulnerability involves a use-after-free condition that can be triggered by processing specially crafted Extensible Stylesheet Language Transformations XSLT. A remote attacker could exploit this to cause memory...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xalan-j2 (UTSA-2026-054046)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054046 advisory. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class...
Use After Free
Amendment This was deemed not a vulnerability. Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Use After Free through the processing of crafted XSLT, which leverages a vulnerable bundled version of libxslt. An attacker can cau...
CVE-2025-71406
Rejected reason: This CVE ID has been rejected as a duplicate...
UBUNTU-CVE-2025-71406
Nokogiri before 1.18.4 bundles a vulnerable version of libxslt prior to 1.1.43 that contains two use-after-free vulnerabilities: CVE-2025-24855 use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt-node and CVE-2024-55549 use-after-free related to excluded result...
CVE-2025-71406 Nokogiri before 1.18.4 Use-After-Free via libxslt
Nokogiri before 1.18.4 bundles a vulnerable version of libxslt prior to 1.1.43 that contains two use-after-free vulnerabilities: CVE-2025-24855 use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt-node and CVE-2024-55549 use-after-free related to excluded result...
CVE-2025-71406
Nokogiri before 1.18.4 bundles libxslt prior to 1.1.43, which contains two use-after-free vulnerabilities: CVE-2025-24855 (XPath context node leak via xsltEvalXPathStringNs) and CVE-2024-55549 (excluded result prefixes/namespaces). Processing crafted XSLT can trigger memory corruption, potentiall...