The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Denial Of Service
Apple
Debian
Canonical
Debian Linux
+7
NVD
CVSS 2.0
2.6
EPSS
1.1%
The default configuration of EMC VPLEX GeoSynchrony 5.4 SP1 before P3 stores cleartext NAVISPHERE GUI passwords in a log file, which allows local users to obtain sensitive information by reading this. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
Information Disclosure
Vplex Geosynchrony
Emc
NVD
CVSS 2.0
2.1
EPSS
0.1%