#cwe-91

共收录 46 条相关情报。

← 返回所有主题

漏洞预警2026-10-13 发布HIGH

Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker coul...

CVE-2026-110084

Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in

来源摘录 · NVD

#cve #cwe-91

漏洞预警2026-09-30 发布INFO

-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execu...

CVE-2026-102116

-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-91

安全公告2026-09-30 发布INFO

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki -...

CVE-2026-103044

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-91

漏洞预警2026-09-29 发布INFO

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - Easy...

CVE-2026-103044

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension a

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-09-23 发布INFO

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.

CVE-2026-76979

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vu

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-09-22 发布INFO

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data...

CVE-2026-65124

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A su

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-09-11 发布INFO

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, which is reachable without authe...

CVE-2026-89247

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in pl

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

安全公告2026-09-11 发布INFO

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML...

CVE-2026-2310

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-91 #severity:high

漏洞预警2026-09-10 发布INFO

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker coul...

CVE-2026-2310

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

安全公告2026-09-08 发布INFO

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

CVE-2026-83616

## Summary `Document.createProcessingInstruction()` in `@xmldom/xmldom` performs no validation on the `target` paramete

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-91 #severity:high

安全公告2026-09-08 发布INFO

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

CVE-2026-83617

## Summary An embedded line terminator bypasses the `requireWellFormed` serializer check for element and attribute name

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-91 #cwe-625 #severity:high

安全公告2026-09-08 发布INFO

xmldom: DocType `name` Injection Bypasses requireWellFormed

CVE-2026-83608

## Summary The `@xmldom/xmldom` serializer emits `DocumentType.name` verbatim into the `` declaration with no well-form

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-91 #severity:high

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer valida...

CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 un

历史摘要 · 未重新核验 · NVD

#cve #cwe-91 #cwe-625

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attri...

CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 un

历史摘要 · 未重新核验 · NVD

#cve #cwe-91 #cwe-625

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versi...

CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js com...

CVE-2026-83609

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 unt

历史摘要 · 未重新核验 · NVD

#cve #cwe-91 #cwe-625

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versi...

CVE-2026-83608

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom versi...

CVE-2026-83607

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom versi...

CVE-2026-83605

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

安全公告2026-09-01 发布INFO

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 un

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-625 #cwe-91