CVE Vulnerability Catalog

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, Document.createProcessingInstruction() accepts an unvalidated target, allowing XML structure injection by breaking the processing-instruction boundary. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.1.5-0.6.0, appendElement in lib/sax.js clones the entire namespace map for each nested element, leading to quadratic memory usage. A small XML document can exhaust the process heap. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.3.0-0.6.0, two independent quadratic paths can cause denial of service: parseElementStartPart repeatedly rescans a malformed tag name, and normalize() repeatedly removes and appends adjacent text nodes. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, DOMHandler.startElement inserts every attribute through setAttributeNode, and NamedNodeMap.setNamedItem performs a linear lookup, leading to quadratic complexity with many attributes. A small XML document can stall the Node.js event loop. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.0-beta.1 to 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles mixed-case closing tags for script, style, textarea, and title elements. This leads to unstable parser progression and quadratic output amplification. A small text/html document can consume disproportionate CPU and memory. This issue is fixed in version 0.9.12.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

In xmldom versions 0.9.0 through 0.9.11, the QName_exact validator uses the multiline flag, accepting malformed XML names containing line terminators. This can lead to markup injection during serialization.

In xmldom before versions 0.8.15 and 0.9.12, and in version 0.6.0 and earlier, the DocumentType.name is not validated and can contain > or whitespace, allowing to break the DOCTYPE declaration and inject additional markup.

In xmldom before versions 0.8.14 and 0.9.11, and in version 0.6.0 and earlier, the element name in createElement is not validated, and XMLSerializer emits it verbatim. This can lead to injection of attributes, elements, or processing instructions into serialized XML/HTML.

In xmldom from version 0.9.0-beta.9 to 0.9.11, the expression used for parsing processing instructions can cause quadratic backtracking on long whitespace tails when the closing ?> is missing. This can stall the Node.js event loop.

In xmldom before versions 0.8.14 and 0.9.11, and in version 0.6.0 and earlier, Element.setAttribute() does not validate the attribute name, and XMLSerializer emits it verbatim. This can lead to injection of additional attributes, including event handlers.

The DefaultBaseTypeLimitingValidator in jackson-databind, applied automatically when @JsonTypeInfo is used without a custom validator, omitted java.lang.Comparable from its list of unsafe base types. As a result, an application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type accepts type identifiers for essentially any class implementing Comparable, giving an attacker-controlled object instantiation primitive. A demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path.

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could exploit this to bypass access restrictions and gain escalated privileges.

Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to gain unauthorized access to sensitive sensitive system information.

An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without error. This could result in memory corruption, device crash, or remote attack vector.

In Erlang/OTP, when using the inet driver with {packet,4} mode, an attacker connecting to an open TCP port can exploit a signed overflow in packet length calculation, potentially overflowing the receive buffer and crashing the BEAM VM.

The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance.

The httpd HTTP server in the inets application fails to enforce a configured body-size limit on chunked requests. This may allow sending very large requests, potentially leading to server overload.

The check_header/3 function in httpd rejects duplicate Content-Length but does not check for the co-presence of Transfer-Encoding and Content-Length, which can lead to request smuggling desynchronization between front-end and back-end.