CVE-2024-55887

A flaw was found in the ucum-java library for FHIR. XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being use...

CVE-2024-55887

Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts...

PT-2024-9589 · Ucum-Java · Ucum-Java

Name of the Vulnerable Software and Affected Versions: Ucum-java versions prior to 1.0.9 Description: The issue is related to XML external entity injections in the UcumEssenceService. This occurs when XML parsing is performed, allowing a malicious DTD tag in a processed XML file to produce XML...

Ucum-java 代码问题漏洞

Ucum-java is a FHIR open source FHIR Java library that provides Ucum services. A code issue vulnerability exists in Ucum-java versions prior to 1.0.9 that stems from the XML parsing performed by the UcumEssenceService being vulnerable to XML external entity injection, resulting in external client...

Adobe Acrobat Reader XML External Entity Injection Vulnerability

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. Adobe Acrobat Reader has an XML External Entity Injection vulnerability that originates from a network system or product that is not set up with the correct filters ...

http4k has a potential XXE (XML External Entity Injection) vulnerability

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. There is a potential XXEXML External Entity Injection vulnerability when http4k...

CVE-2024-55875

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE XML External Entity Injection vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server,...

CVE-2024-55875 http4k has a potential XXE (XML External Entity Injection) vulnerability

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE XML External Entity Injection vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server,...

CVE-2024-55875 http4k has a potential XXE (XML External Entity Injection) vulnerability

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE XML External Entity Injection vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server,...

Adobe Acrobat Reader 代码问题漏洞

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. Adobe Acrobat Reader has an XML External Entity Injection vulnerability that originates from a network system or product that is not set up with the correct filters ...

PT-2024-36012 · Siemens · Comos

Name of the Vulnerable Software and Affected Versions: COMOS V10.3 versions prior to V10.3.3.5.8 COMOS V10.4.0 versions prior to V10.4.0 COMOS V10.4.1 versions prior to V10.4.1 COMOS V10.4.2 versions prior to V10.4.2 COMOS V10.4.3 versions prior to V10.4.3.0.47 COMOS V10.4.4 versions prior to...

XML External Entity (XXE) Injection

Overview unstructured is an A library that prepares raw documents for downstream ML tasks. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the XMLParser. An attacker can access sensitive data or cause denial of service by supplying malicious XML content...

Security Bulletin: IBM Sterling B2B Integrator is affected by multiple security vulnerabilities in IBM WebSphere Application Server

Summary IBM Sterling B2B Integrator is affected by multiple security vulnerabilities in IBM WebSphere Application Server Vulnerability Details CVEID:CVE-2023-31582 DESCRIPTION: Jose4J could allow a remote attacker to obtain sensitive information, caused by allowing of a low iteration count of 100...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to improper sanitization of XML body in the fromString function. Workaround Remove the LIBXMLDTDLOAD | LIBXMLDTDATTR options from $options Details XXE Injection is a type of attack against an...

SimpleSAMLphp 安全漏洞

SimpleSAMLphp is a PHP authentication application that implements SAML 2.0 service provider and identity provider functionality. A security vulnerability exists in SimpleSAMLphp that originates when xml-common loads an untrusted XML document, inducing XML external entity injection...

CVE-2024-52800 Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. This doesn't affect the standard validation and policy checks functionality...

CVE-2024-52800 Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. This doesn't affect the standard validation and policy checks functionality...

XML Entity Injection Vulnerability in U8Cloud of UFIDA Network Technology Co.

U8cloud is a new-generation cloud ERP launched by UFIDA, which mainly focuses on growing and innovative enterprises and provides enterprise-level cloud ERP total solutions. UFIDA U8Cloud suffers from an XML entity injection vulnerability that can be exploited by attackers to obtain sensitive...

XML External Entity (XXE) Injection

HAPI FHIR is vulnerable to XML External Entity XXE Injection. The vulnerability is due to insecure XML parsing by HAPI FHIR, specifically within the XSLT parsing components, which improperly handle external entity references in XML files. It allows attackers to inject malicious XML content, such ...

Security Bulletin: Financial Transaction Manager v4 is impacted by multiple vulnerabilities in WebSphere Liberty

Summary Multiple vulnerabilities were addressed in Financial Transaction Manager 4.0.6.0 iFix4 Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External...