BIT-NIFI-2022-29265 Improper Restriction of XML External Entity References in Multiple Components

Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML...

BIT-NIFI-2020-13940

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

Improper Access Control

com.liferay.portal, release.portal.bom is vulnerable to Improper Access Control. The vulnerability is due to insufficient access restrictions on files uploaded via forms and stored in the documentlibrary, which allows an attacker to directly access these files through crafted URLs without...

Advisory ROSA-SA-2025-2991

software: ghostscript 9.56.1 OS: ROSA-CHROME unaffected versions = ghostscript-9.56.1-7 affected versions ghostscript-9.56.1-7 CVE-ID: CVE-2025-48708 BDU-ID: 2025-06028 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the gslibctxctxstashsanitizedarg function of the base/gslibctx.c file of the...

xml2rfc is vulnerable to arbitrary file reads through prepped files

Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. References This is related ...

CVE-2025-10209 Papermerge DMS Authorization Token improper authorization

A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Performing manipulation results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public...

Linux Distros Unpatched Vulnerability : CVE-2024-12539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security ...

Linux Distros Unpatched Vulnerability : CVE-2020-13240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions...

Linux Distros Unpatched Vulnerability : CVE-2023-6194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition DTD references to external...

Linux Distros Unpatched Vulnerability : CVE-2020-14201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in...

Linux Distros Unpatched Vulnerability : CVE-2011-1204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Google Chrome before 10.0.648.127 does not properly handle attributes, which allows remote attackers to cause a denial of service DOM tree corruption or possibl...

Linux Distros Unpatched Vulnerability : CVE-2017-14240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter. CVE-2017-14240 Note that...

Linux Distros Unpatched Vulnerability : CVE-2018-1000840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Processing Foundation Processing version 3.4 and earlier contains a XML External Entity XXE vulnerability in loadXML function that can result in An attacker can...

ROS-20250910-04

AV3DVirtAnnot vulnerability in Adobe Acrobat Document Cloud PDF viewers and editors. Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2020, Adobe Acrobat 2024, Adobe Acrobat Reader 2020 is related to the ability to use memory after it has been freed. Exploitation of the vulnerability cou...

Linux Distros Unpatched Vulnerability : CVE-2023-6299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1. This issue affects some unknown processing of the file...

Linux Distros Unpatched Vulnerability : CVE-2024-39126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. CVE-2024-39126 Note that Nessus relies on the presence of the package as reported...

From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks

Cybersecurity researchers have disclosed details of a phishing campaign that delivers a stealthy banking malware-turned-remote access trojan called MostereRAT. The phishing attack incorporates a number of advanced evasion techniques to gain complete control over compromised systems, siphon...

CVE-2025-42927

SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability ha...

CVE-2025-42927

CVE-2025-42927 affects SAP NetWeaver AS Java via the Adobe Document Service, where a vulnerable OpenSSL version is bundled. Root cause is outdated OpenSSL in the SAP NetWeaver AS Java platform; exploitation could enable a high-privilege user to access and modify system information. Impact is low ...

CVE-2025-42927 Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)

SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability ha...