19364 matches found
Astra Linux – Vulnerability in c3p0
C3P0 versions less than 0.9.5.4 may be exploited by a “billion laughs attack” when loading XML configuration, due to the lack of protections against recursive entity expansion during the loading of configuration files...
Astra Linux – Vulnerability in libpgjava
The PostgreSQL JDBC Driver also known as PgJDBC prior to version 42.2.13 allowed XXE...
Astra Linux – Vulnerability in libxml2
A flaw was discovered in libxml2. Exponential entity expansion could potentially bypass all existing protection mechanisms, leading to a denial of service...
Astra Linux – Vulnerability in JGit
In Eclipse JGit versions 7.2.0.202503040940-r and earlier, the ManifestParser class used by the repo command, and the AmazonS3 class used to implement the experimental amazons3 Git transport protocol—which allows storing Git package files in an Amazon S3 bucket—are vulnerable to XML External Enti...
Astra Linux – Vulnerability in libxml2
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier, as well as other products, does not provide a direct flag indicating that the current document may be read, but other files may not be opened. This makes it easier for remote attackers to carry out XML External Entity XXE attacks...
Astra Linux – Vulnerability in snakeyaml
The Alias feature in SnakeYAML before version 1.26 allowed entity expansion during a load operation, which is a related issue to CVE-2003-1564...
Astra Linux - Vulnerability in libjdom1-java, libjdom2-java
A XXE vulnerability exists in SAXBuilder in JDOM through version 2.0.6, allowing attackers to cause a denial of service through a crafted HTTP request...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: The double-free operation in dvbregisterdevice has been fixed. In the function dvbregisterdevice - dvbregistermediadevice - dvbcreatemediaentity, the dvb-entity is allocated and initialized. If the initialization...
Astra Linux – Vulnerability in Ruby 2.5
REXML is an XML toolkit for Ruby. The REXML gem version 3.3.2 has a DoS vulnerability when it parses an XML document that contains many entity expansions using SAX2 or the pull parser API. The REXML gem versions 3.3.3 and later include a patch to fix this vulnerability...
Astra Linux – Vulnerability in lxml
Lxml is a library for processing XML and HTML in the Python language. Prior to version 6.1.0, using either of the two parsers with the default configuration with resolveentities=True allowed untrusted XML input to access local files. Setting the resolveentities option explicitly to...
Astra Linux – Vulnerability in Jackson-Databind
A flaw was discovered in FasterXML Jackson Databind; it does not properly secure entity expansion. This flaw exposes the system to XML external entity XXE attacks. The most significant threat from this vulnerability is data integrity...
Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13287)
Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer monitor result parser Vulnerability Details CVEID:CVE-2026-13287 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could...
CVE-2023-46035
The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...
CVE-2023-46035
The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...
CVE-2026-91197: Improper Restriction of XML External Entity Reference
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2023-46035
The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...
PT-2026-91755
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2023-46035: Improper Restriction of Recursive Entity References in DTDs
The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...
CVE-2026-13285: Improper Restriction of XML External Entity Reference
IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...
