CVE Vulnerability Catalog

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.7.0 to 0.8.15, the parser in lib/sax.js uses an unanchored global expression to trim end-tag names, leading to quadratic backtracking on long whitespace runs. A small unauthenticated XML document can stall the Node.js event loop. This issue is fixed in version 0.8.15.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.10 to 0.9.12, validation of DocumentType.publicId and systemId using expressions with the multiline flag allows bypassing validation and injecting markup into the <!DOCTYPE> declaration. This issue is fixed in version 0.9.12.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.11 to 0.9.12, element and attribute name checks using the QName_exact expression with the multiline flag allow bypassing validation and injecting markup into element or attribute names. This issue is fixed in version 0.9.12.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, Document.createProcessingInstruction() accepts an unvalidated target, allowing XML structure injection by breaking the processing-instruction boundary. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.1.5-0.6.0, appendElement in lib/sax.js clones the entire namespace map for each nested element, leading to quadratic memory usage. A small XML document can exhaust the process heap. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.3.0-0.6.0, two independent quadratic paths can cause denial of service: parseElementStartPart repeatedly rescans a malformed tag name, and normalize() repeatedly removes and appends adjacent text nodes. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, DOMHandler.startElement inserts every attribute through setAttributeNode, and NamedNodeMap.setNamedItem performs a linear lookup, leading to quadratic complexity with many attributes. A small XML document can stall the Node.js event loop. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.0-beta.1 to 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles mixed-case closing tags for script, style, textarea, and title elements. This leads to unstable parser progression and quadratic output amplification. A small text/html document can consume disproportionate CPU and memory. This issue is fixed in version 0.9.12.

In xmldom versions 0.9.0 through 0.9.11, the QName_exact validator uses the multiline flag, accepting malformed XML names containing line terminators. This can lead to markup injection during serialization.

In xmldom before versions 0.8.15 and 0.9.12, and in version 0.6.0 and earlier, the DocumentType.name is not validated and can contain > or whitespace, allowing to break the DOCTYPE declaration and inject additional markup.

In xmldom before versions 0.8.14 and 0.9.11, and in version 0.6.0 and earlier, the element name in createElement is not validated, and XMLSerializer emits it verbatim. This can lead to injection of attributes, elements, or processing instructions into serialized XML/HTML.

In xmldom from version 0.9.0-beta.9 to 0.9.11, the expression used for parsing processing instructions can cause quadratic backtracking on long whitespace tails when the closing ?> is missing. This can stall the Node.js event loop.

In xmldom before versions 0.8.14 and 0.9.11, and in version 0.6.0 and earlier, Element.setAttribute() does not validate the attribute name, and XMLSerializer emits it verbatim. This can lead to injection of additional attributes, including event handlers.

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could exploit this to bypass access restrictions and gain escalated privileges.

In Erlang/OTP, when using the inet driver with {packet,4} mode, an attacker connecting to an open TCP port can exploit a signed overflow in packet length calculation, potentially overflowing the receive buffer and crashing the BEAM VM.

The httpd HTTP server in the inets application fails to enforce a configured body-size limit on chunked requests. This may allow sending very large requests, potentially leading to server overload.

The check_header/3 function in httpd rejects duplicate Content-Length but does not check for the co-presence of Transfer-Encoding and Content-Length, which can lead to request smuggling desynchronization between front-end and back-end.

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.

A vulnerability in the inets HTTP server in Erlang/OTP allows a remote unauthenticated attacker to read files in a mod_auth protected directory by requesting them with different casing, on case-insensitive filesystems. The path check does not use the caseless option, allowing authentication bypass.

A vulnerability in the inets HTTP server in Erlang/OTP allows a remote unauthenticated attacker to cause denial of service by sending valid headers with a large Content-Length and then stalling. The server cancels the request timeout after header parsing and does not re-arm it, leaving workers waiting indefinitely.