ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Vulnerabilities

2 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos

ShowKEV onlyPublic PoCCVSS ≥ 9CVSS ≥ 7EPSS ≥ 10%EPSS ≥ 50%Window24h7d30d90dAll
StackAllWordPressE-commerceDrupalJoomlanpmpipMavenGoPackagistRubyGemsNuGet
SortpublishedepsscvssKEV dateupdatedvendor: xml language server project ✕
CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2019-18213
+1 in the same advisory: …18212
XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allo

XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with resultant SSRF (as well as SMB connection initiation that can lead to NetNTLM challenge/response capture for password cracking). This occurs in extensions/contentmodel/participants/diagnostics/LSPXMLParserConfiguration.java.

NVD description · AI analysis pending		8.8
group max
2% PoC
  • xml language server project xml server project
  • xml language server project wild web developer
  • xml language server project theia xml extension
—