The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Denial Of Service
Debian Linux
Libxml2
Iphone Os
Mac Os X
+3
NVD
CVSS 2.0
2.6
EPSS
1.1%
The default configuration of EMC VPLEX GeoSynchrony 5.4 SP1 before P3 stores cleartext NAVISPHERE GUI passwords in a log file, which allows local users to obtain sensitive information by reading this. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
Information Disclosure
Vplex Geosynchrony
NVD
CVSS 2.0
2.1
EPSS
0.1%