Tag
Multiple Vulnerabilities in expat XML Parser Library
2 rules 2 TTPsMultiple vulnerabilities have been discovered in the expat XML parser library that can be exploited by a local attacker, potentially leading to a Denial of Service condition or allowing for arbitrary code execution on the affected system.
ImageMagick XML Bomb Denial-of-Service Vulnerability (CVE-2026-33908)
2 rules 1 TTP 1 CVEImageMagick versions prior to 7.1.2-19 and 6.9.13-44 are susceptible to a denial-of-service (DoS) attack due to unbounded recursion during XML parsing, potentially leading to stack exhaustion.
CPCI85 and SICORE Base System XML Out-of-Bounds Write Vulnerability
2 rules 1 TTPAn unauthenticated attacker can exploit an out-of-bounds write vulnerability in CPCI85 Central Processing/Communication and SICORE Base System by sending a malicious XML request, potentially causing a service crash leading to a denial-of-service condition.
xmldom XML Node Injection via Comment Serialization
2 rules 1 TTPThe xmldom library is vulnerable to XML node injection, allowing attackers to inject arbitrary XML nodes into serialized output by manipulating comment content; this is mitigated by using the `requireWellFormed` option in `serializeToString` after upgrading to version 0.8.13 or 0.9.10.
PhpSpreadsheet XML Reader Denial of Service via Unbounded Row Index
2 rules 1 TTPPhpSpreadsheet is vulnerable to a denial-of-service attack by crafting a SpreadsheetML XML file with an excessively large row index, which exhausts server CPU resources due to unbounded iteration.
fast-xml-builder Vulnerability Allows Attribute Injection
2 rules 1 TTPThe fast-xml-builder library allows attribute injection when handling attribute values containing quotes, leading to potential execution of arbitrary code.