There are no known workarounds apart from upgrading to a version including the fix. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by making sure that data attributes only contain allowed characters. The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid ` are removed in all attribute names. XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Provider (IP) to impersonate any TOPdesk user via SAML Response manipulation. FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c.
0 kommentar(er)
