Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntuUbuntuUSN-6102-1
HistoryMay 24, 2023 - 12:00 a.m.

xmldom vulnerabilities

2023-05-2400:00:00
ubuntu.com
29
ubuntu
xmldom
javascript
cve-2021-21366
cve-2022-37616
cve-2022-39353
denial of service
xml processing
remote attacker
lts
packages

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

Low

EPSS

0.003

Percentile

69.7%

JSON

Releases

  • Ubuntu 22.10
  • Ubuntu 22.04 LTS
  • Ubuntu 20.04 LTS

Packages

  • node-xmldom - A pure JavaScript W3C standard-based DOMParser and XMLSerializer module.

Details

It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause
unexpected syntactic changes during XML processing. This issue only affected
Ubuntu 20.04 LTS. (CVE-2021-21366)

It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-37616, CVE-2022-39353)

OSVersionArchitecturePackageVersionFilename
Ubuntu22.10noarchnode-xmldom< 0.7.5-1ubuntu0.22.10.1UNKNOWN
Ubuntu22.04noarchnode-xmldom< 0.7.5-1ubuntu0.22.04.1UNKNOWN
Ubuntu20.04noarchnode-xmldom< 0.1.27+ds-1+deb10u2build0.20.04.1UNKNOWN

Related

osv 9
openvas 3
nessus 4
debian 2
prion 3
ibm 12
ubuntucve 3
cbl_mariner 2
veracode 3
cve 3
debiancve 3
cvelist 3
nvd 3
github 3
nodejs 1
redhatcve 2
osv
osv
node-xmldom vulnerabilities
2023-05-24 09:57:50
node-xmldom - security update
2023-01-01 00:00:00
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
2022-10-11 20:42:57
openvas
openvas
Ubuntu: Security Advisory (USN-6102-1)
2023-05-25 00:00:00
Debian: Security Advisory (DLA-3260-1)
2023-01-02 00:00:00
Debian: Security Advisory (DLA-3154-1)
2022-10-19 00:00:00
nessus
nessus
Ubuntu 20.04 LTS / 22.04 LTS : xmldom vulnerabilities (USN-6102-1)
2023-05-24 00:00:00
Debian DLA-3260-1 : node-xmldom - LTS security update
2023-01-07 00:00:00
Debian DLA-3154-1 : node-xmldom - LTS security update
2022-10-18 00:00:00
debian
debian
[SECURITY] [DLA 3260-1] node-xmldom security update
2023-01-01 17:00:48
[SECURITY] [DLA 3154-1] node-xmldom security update
2022-10-18 15:06:03
prion
prion
Sql injection
2022-10-11 05:15:00
Input validation
2021-03-12 17:15:00
Design/Logic Flaw
2022-11-02 17:15:00
ibm
ibm
Security Bulletin: IBM App Connect Enterprise Certified Container operands that process XML may be vulnerable to arbitrary code execution due to [CVE-2022-37616]
2022-12-01 16:19:56
Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to privilege escalation due to CVE-2022-39353
2022-12-01 16:35:30
Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote code execution due to xmldom vulnerability [CVE-2022-37616]
2023-01-03 09:05:49
ubuntucve
ubuntucve
CVE-2022-37616
2022-10-11 00:00:00
CVE-2021-21366
2021-03-12 00:00:00
CVE-2022-39353
2022-11-02 00:00:00
cbl_mariner
cbl_mariner
CVE-2022-37616 affecting package python-tensorboard for versions less than 2.16.2-1
2024-05-17 21:38:35
CVE-2022-39353 affecting package python-tensorboard for versions less than 2.16.2-1
2024-05-17 21:38:35
veracode
veracode
Prototype Pollution
2022-10-12 07:30:56
Improper Input Validation
2022-11-03 05:26:31
Misinterpretation Of Malicious XML Input
2021-03-10 07:22:41
cve
cve
CVE-2022-37616
2022-10-11 05:15:10
CVE-2021-21366
2021-03-12 17:15:12
CVE-2022-39353
2022-11-02 17:15:17
debiancve
debiancve
CVE-2022-37616
2022-10-11 05:15:10
CVE-2021-21366
2021-03-12 17:15:12
CVE-2022-39353
2022-11-02 17:15:17
cvelist
cvelist
CVE-2022-37616
2022-10-11 00:00:00
CVE-2021-21366 Misinterpretation of malicious XML input
2021-03-12 00:00:00
CVE-2022-39353 xmldom allows multiple root nodes in a DOM
2022-11-02 00:00:00
nvd
nvd
CVE-2022-37616
2022-10-11 05:15:10
CVE-2021-21366
2021-03-12 17:15:12
CVE-2022-39353
2022-11-02 17:15:17
github
github
Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
2022-10-11 20:42:57
Misinterpretation of malicious XML input
2021-03-12 22:39:39
xmldom allows multiple root nodes in a DOM
2022-11-01 17:29:11
nodejs
nodejs
Misinterpretation of malicious XML input
2021-03-12 22:42:38
redhatcve
redhatcve
CVE-2021-21366
2023-05-29 18:40:08
CVE-2022-39353
2022-11-14 03:56:39

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

Low

EPSS

0.003

Percentile

69.7%

JSON
Related for USN-6102-1
osv9openvas3nessus4debian2prion3ibm12ubuntucve3cbl_mariner2veracode3cve3debiancve3cvelist3nvd3github3nodejs1redhatcve2