CVE-2019-19144: Improper Restriction of Recursive Entity References in DTDs

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 11449-53631 Build304 devices via rest/Users?action=authenticate...

CVE-2019-19144

The Quantum DXi6702 backup and deduplication appliance, specifically version 2.3.0.3 (11449-53631 Build304) , is vulnerable to an XML External Entity Injection (XXE) vulnerability. The root cause is the improper limitation of XML links to external objects within the /rest/Users?action=authenticat...

Dell SmartFabric OS10 Software Code Issue Vulnerability

Dell SmartFabric OS10 Software is network operating system software developed by Dell to simplify the management and automation of data center network architectures. A security vulnerability exists in Dell SmartFabric OS10 Software versions prior to 10.6.0.5 that stems from improper handling of X...

PT-2025-31644 · Quantum · Quantum Dxi6702

Name of the Vulnerable Software and Affected Versions: Quantum DXi6702 version 2.3.0.3 11449-53631 Build304 Description: An XML External Entity Injection issue exists in Quantum DXi6702 devices. The vulnerability is located in the /rest/Users?action=authenticate API endpoint. Recommendations: At...

CVE-2019-19144

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 11449-53631 Build304 devices via rest/Users?action=authenticate...

CVE-2025-26400

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...

VulnCheck KEV: CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection...

CVE-2025-36608

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2025-36608

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2025-36608

CVE-2025-36608 affects Dell SmartFabric OS10 Software prior to 10.6.0.5. The issue is an improper restriction of XML External Entity references in OS10, enabling a low-privileged, remote attacker to potentially gain unauthorized access. Impact is described as unauthorized access with Network atta...

DRUPAL-CONTRIB-2025-093

This module enables you to access an edit page for a config page. The module doesn't sufficiently check the access permissions hookENTITYTYPEaccess wasn't taken into account. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config page" an...

XML Entity Expansion

Overview Affected versions of this package are vulnerable to XML Entity Expansion via the messagemaxbytesize setting configured in the decoderawsaml function. An attacker can cause resource exhaustion by submitting a specially crafted large SAML response that is validated for Base64 format before...

Malicious code in stream-loggers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c02793265c4ba517b0a8883b03a45f3e045877b20c4abbcf4b27999bce7b68de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-loggerx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25f40908b2a7b04409b374e0ebaa8c64795147e55c355bdc0c3d3d783d5180e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-rtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9dca49a40515fc43ab5bb3d987aa551a6464961dd1aee2b3e4cadae66831a01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Dell SmartFabric OS10 Software 代码问题漏洞

Dell SmartFabric OS10 Software is network operating system software developed by Dell to simplify the management and automation of data center network architectures. A security vulnerability exists in Dell SmartFabric OS10 Software versions prior to 10.6.0.5 that stems from improper handling of X...

CVE-2025-36608: Improper Restriction of XML External Entity Reference

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

PT-2025-31382 · Dedupe · Dedupe

Name of the Vulnerable Software and Affected Versions: dedupe versions prior to commit 3f61e79 Description: dedupe is a Python library used for fuzzy matching, deduplication, and entity resolution on structured data. A critical severity issue exists in the .github/workflows/benchmark-bot.yml...

Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093

This module enables you to access an edit page for a config page. The module doesn't sufficiently check the access permissions hookENTITYTYPEaccess wasn't taken into account. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config page" an...

SUSE CVE-2025-38436

In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: signal scheduled fence when kill job When an entity from application B is killed, drmschedentitykill removes all jobs belonging to that entity through drmschedentitykilljobswork. If application A's job depends on a...