CVE-2025-36049

IBM webMethods Integration Server (on‑prem) versions 10.5, 10.7, 10.11, and 10.15 are affected by CVE-2025-36049 due to an XML external entity (XXE) processing vulnerability in XML data handling. The underlying issue is XXE which could allow a remote authenticated attacker to execute arbitrary co...

CVE-2025-36049 IBM webMethods Integration Sever XML external entity injection

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands...

CVE-2025-36049 IBM webMethods Integration Sever XML external entity injection

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands...

Malicious code in dijit._widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa0d60292f6c7957aa330c2c5c33bd9c9bf860f405a547f3cdadd639fa980fd5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

IBM webMethods Integration 代码问题漏洞

IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. A code issue vulnerability exists in IBM webMethods Integration Server versions 10.5, 10.7, 10.11, and 10.15 that stems from an XML external entity injection vulnerability that could lead to the...

PT-2025-26179 · Ibm · Webmethods Integration Server

Name of the Vulnerable Software and Affected Versions: IBM webMethods Integration Server versions 10.5, 10.7, 10.11, and 10.15 Description: The issue is related to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this to execute...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

In libexpat version 2.6.1, an XML Entity Expansion attack is possible when external parsers are used in isolation created using XMLExternalEntityParserCreate...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: The issue of se-slice being set to U64MAX and resulting in a crash has been fixed. There is a code path in dequeueentities that can set the slice of a schedentity to U64MAX. This sometimes leads to a crash. The...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/sched: Fixed the leak caused by referencing the fence’s reference count. The lastscheduled fence leaks occurs when an entity is being terminated, and the cleanup callback fails. The reference count of prev was decremented...

TencentOS Server 2: pki-core (TSSA-2022:0289)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0289 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

The vulnerability of the gt-xsd-core and gt-wfs-ng libraries of GeoTools allows attackers to perform XXE attacks.

The vulnerability of the gt-xsd-core and gt-wfs-ng libraries of GeoTools is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to perform XXE attacks remotely...

libxslt:xslt: Heap-buffer-overflow in xmlParsePubidLiteral

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed Report: https://oss-fuzz.com/testcase?key=5151312318889984 Project: libxslt Fuzzing Engine: libFuzzer Fuzz Target: xslt Job Type: libfuzzerasanlibxslt Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

Security update for libxml2

This update for libxml2 fixes the following issues: CVE-2024-40896: Fixed XXE vulnerability bsc1234812 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your...

ffmpeg:ffmpeg_dem_DASH_fuzzer: Heap-buffer-overflow in xmlParsePubidLiteral

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4850228937424896 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegdemDASHfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x50f0000001d4 Cra...

Malicious code in zora-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2764c900ca7254d541cb02d4393365a610648e80866768703dcae298b4f3a4b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zora-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5434c40d3048f846ef1d268e25b386ee6000460a939ff2aa2d91dd67ea1e897d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in solanautil (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8a994a5a77cea13db3655b647260e91eb43eaf01123269218c0378fdd8d94db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-44044

Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity XXE. An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system...

Differentially Private Relational Learning with Entity-Level Privacy Guarantees

Learning with relational and network-structured data is increasingly vital in sensitive domains where protecting the privacy of individual entities is paramount. Differential Privacy DP offers a principled approach for quantifying privacy risks, with DP-SGD emerging as a standard mechanism for...

Medium: qt

Issue Overview: An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. CVE-2023-38197 Affected Packages: qt Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this F...