CVE-2019-9628

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.

• CWE-755

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.htmlMailing List, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912Issue Tracking, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190611-0003/Third Party Advisory
• https://shibboleth.net/community/advisories/secadv_20190311.txtThird Party Advisory
• https://usn.ubuntu.com/3921-1/Third Party Advisory
• https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisoriesThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.htmlMailing List, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912Issue Tracking, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190611-0003/Third Party Advisory
• https://shibboleth.net/community/advisories/secadv_20190311.txtThird Party Advisory
• https://usn.ubuntu.com/3921-1/Third Party Advisory
• https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisoriesThird Party Advisory

Published

Apr 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9622eBrigade through 4.5 allows Arbitrary File Download via ../ …
• CVE-2019-9623Feng Office 3.7.0.5 allows remote attackers to execute arbit…
• CVE-2019-9624Webmin 1.900 allows remote attackers to execute arbitrary co…
• CVE-2019-9625JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN…
• CVE-2019-9626PHPSHE 1.7 allows module/index/cart.php pintuan_id SQL Injec…
• CVE-2019-9627A buffer overflow in the kernel driver CybKernelTracker.sys …7
• CVE-2019-9629Sonatype Nexus Repository Manager before 3.17.0 establishes …
• CVE-2019-9630Sonatype Nexus Repository Manager before 3.17.0 has a weak d…
• CVE-2019-9631Poppler 0.74.0 has a heap-based buffer over-read in the Cair…
• CVE-2019-9632ESAFENET CDG V3 and V5 has an arbitrary file download vulner…
• CVE-2019-9633gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure tha…
• CVE-2019-9634Go through 1.12 on Windows misuses certain LoadLibrary funct…7.8