98 results · Feed
-
High 7.5
Denial of service or RCE from libxml2 and libxslt
dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.
-
Unscored —CVE-2015-8710 Public exploit
The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a deni…
-
High 8.1
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffe…
-
Unscored —
The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-boun…
-
Medium —
Heap-based buffer overflow in nokogiri
Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
-
Unscored —
Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-depe…
-
Unscored —
The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of s…
-
Unscored —
Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent…
-
Unscored —
The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-…
-
Unscored —
The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive…
-
Unscored —
The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers t…
-
High —
Nokogiri subject to DoS via libxml2 vulnerability
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability tha…
-
Unscored —
The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it st…
-
Unscored —
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial …
-
Unscored —
The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-de…
-
Medium —
Nokogiri vulnerable to libxml XML Entity Expansion
The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
-
Unscored —
The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Ser…
-
Unscored —
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disa…