CVE-2025-52888

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser DocumentBuilderFactory and...

Allure Report allows Improper XXE Restriction via DocumentBuilderFactory

Summary A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitra...

GHSA-H7QF-QMF3-85QG Allure Report allows Improper XXE Restriction via DocumentBuilderFactory

Summary A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitra...

CVE-2025-52888

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser DocumentBuilderFactory and...

CVE-2025-52888 Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser DocumentBuilderFactory and...

CVE-2025-52888 Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser DocumentBuilderFactory and...

CVE-2025-52888

CVE-2025-52888 affects Allure 2’s xunit-xml-plugin (pre-2.34.1). The vulnerability arises from insecure configuration of the XML parser (DocumentBuilderFactory), allowing external entity expansion during processing of test result XML files. Impact: arbitrary file disclosure and potential SSRF. Re...

CVE-2025-52888 Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser DocumentBuilderFactory and...

Allure Report 代码问题漏洞

Allure Report is a flexible, lightweight, multi-language test reporting tool from the Allure Framework open source. A code issue vulnerability exists in Allure Report 2 versions prior to 2.34.1, which stems from xunit-xml-plugin not securely configuring the XML parser, which could lead to XXE...

PT-2025-26776 · Unknown +1 · Xunit-Xml-Plugin +1

Name of the Vulnerable Software and Affected Versions: Allure 2 versions prior to 2.34.1 Description: A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external...

com.intuit.karate:karate-gatling (=1.3.1), com.intuit.karate:karate-junit4 (=1.3.1) +4 more potentially affected by CVE-2023-1370 via com.intuit.karate:karate-core (=1.3.1)

com.intuit.karate:karate-core MAVEN version =1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.intuit.karate:karate-core and may be impacted: - com.intuit.karate:karate-gatling =1.3.1 - com.intuit.karate:karate-junit4 =1.3.1 -...

allure-atlantique.com Cross Site Scripting vulnerability OBB-2899394

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in allure-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02fc78ee0f7c9fcd58f858eb047ed7d249eaa5a9b8327d030cd11e538c072fd7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-945 Malicious code in allure-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02fc78ee0f7c9fcd58f858eb047ed7d249eaa5a9b8327d030cd11e538c072fd7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

allure-federation.fr Cross Site Scripting vulnerability OBB-2560374

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

HybridTestFramework - End To End Testing Of Web, API And Security

Full-fledged WEB, API and Security testing framework using selenium,ZAP OWASP proxy and rest-assured Supported Platforms This framework supports WebUi automation across a variety of browsers like Chrome, Firefox, IE, no only limited to this but extended to test rest api, security and visual...

allure.newscom.com Open Redirect vulnerability OBB-2142089

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

allure-kauai.com XSS vulnerability

Open Bug Bounty ID: OBB-469805 Description| Value ---|--- Affected Website:| allure-kauai.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Abbott Laboratories Multiple Pacemaker Products Access Count Limit Vulnerability

Accent, Anthem, Accent MRI, Assurity, Allure and Assurity MRI are implantable medical devices from Abbott Laboratories USA. The access limit vulnerability exists in several Abbott Laboratories pacemaker products, where the pacemaker does not limit or restricts the number of properly formatted "RF...

Abbott Laboratories Multiple Pacemaker Products Erroneously Encrypt Sensitive Data Vulnerability

Accent, Anthem, Accent MRI, Assurity, Allure and Assurity MRI are implantable medical devices from Abbott Laboratories USA. Multiple Abbott Laboratories pacemaker products are vulnerable to incorrectly encrypting sensitive data, with the Accent and Anthem pacemakers transmitting unencrypted patie...