20268 matches found
PT-2026-36153
Name of the Vulnerable Software and Affected Versions SpringBlade version 4.8.0 Description An XML external entity XXE flaw in the "/designer/loadReport" endpoint allows authenticated attackers to execute arbitrary code by injecting a crafted payload. XXE is a type of attack where an application...
CVE-2026-36765
The SpringBlade microservices development platform (v4.8.0) is vulnerable to an XML external entity (XXE) injection flaw in the /designer/loadReport endpoint. This vulnerability allows authenticated attackers to execute arbitrary code by injecting a crafted payload. No specific remediation or exp...
Open Redirect
Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Open Redirect in the handleSSORequest process. An attacker can obtain sensitive user identity attributes and impersonate users by...
[SECURITY] [DSA 6237-1] openjdk-17
------------------------------------------------------------------------- Debian Security Advisory DSA-6237-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 29, 2026 https://www.debian.org/security/faq -...
expat: Fix of 3 CVEs
CVE-2017-9233: Fix external entity infinite loop bug - CVE-2018-20843: Fix extraction of namespace prefix from XML name - CVE-2019-15903: Deny internal entities closing the doctype heap overread...
CLSA-2026-1777304792 expat: Fix of 3 CVEs
CVE-2017-9233: Fix external entity infinite loop bug - CVE-2018-20843: Fix extraction of namespace prefix from XML name - CVE-2019-15903: Deny internal entities closing the doctype heap overread...
libxml2: libxml2: Denial of Service via crafted XSD-validated document
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition XSD validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that...
CVE-2026-6807
GRASSMARLIN v3.2.1 exposes an XML External Entity (XXE) vulnerability. A crafted session data input can trigger improper XML parsing, potentially leaking sensitive information. A public exploit PoC indicates OOB file exfiltration via an external DTD reference, with the attacker able to base64-enc...
CVE-2026-6807 NSA GRASSMARLIN Improper Restriction of XML External Entity Reference
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process...
Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty
Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-33151 DESCRIPTION: Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prio...
CVE-2026-6807: Improper Restriction of XML External Entity Reference
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process...
[SECURITY] [DSA 6231-1] openjdk-21 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6231-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 27, 2026 https://www.debian.org/security/faq -...
CLSA-2026-1777305047 expat: Fix of 3 CVEs
CVE-2017-9233: Fix external entity infinite loop bug - CVE-2018-20843: Fix extraction of namespace prefix from XML name - CVE-2019-15903: Deny internal entities closing the doctype heap overread...
CVE-2018-25282
A flaw was found in Nmap and ZenMap. A local attacker could exploit this vulnerability by crafting a malicious XML file with nested entity definitions. When this file is opened through ZenMap's scan import functionality, it causes the program to consume excessive system resources, leading to a...
CVE-2018-25282 Nmap 7.70 Denial of Service via XML Entity Expansion
Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import...
EUVD-2018-21802
Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import...
CVE-2018-25282
Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import...
CVE-2018-25282
Nmap 7.70 is affected by a local denial-of-service vulnerability caused by exponential XML entity expansion in XML processing (triggered via ZenMap scan import). A crafted XML file with nested entity definitions can cause excessive resource consumption, potentially crashing the application. The C...
CVE-2018-25282 Nmap 7.70 Denial of Service via XML Entity Expansion
Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import...
