Security Bulletin: IBM Engineering Requirements Management DOORS Next is vulnerable to Xml Entity Injection (CVE-2024-39726)

Summary IBM Engineering Requirements Management DOORS Next is vulnerable to Xml Entity Injection CVE-2024-39726. Vulnerability Details CVEID:CVE-2024-39726 DESCRIPTION: IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection...

MAL-2025-1569 Malicious code in aem-headless-web-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c61c407a36f3724be9f3b666bcb222c01ec3ccc693d6ed84475acbaf185abede Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tedrertrtrtst (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdf77e0f8793f6db3affddedfb08d60085dbbfad04ed2b0f20ef2cecf43ff283 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2025-1201 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free +0.000021 BUG: KASAN: slab-use-after-free in drmschedentityflush+0x6cb/0x7a0 gpusched +0.000027 Read of size 8 at addr...

Malicious code in all.en.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c395f6ed37dd1a8e6b2b15422babd65aa6c8f28456ef07e8951ac7ede5c47173 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML Entity Expansion vulnerability in Sitemap parser

Description There is an XML entity expansion billion laughs vulnerability in the sitemap parser. When accessing a malicious Sitemap XML, this results in a Denial of Service. Vulnerable class: import urllib.request import xml.etree.ElementTree as ET from typing import List from...

Azure Linux 3.0 Security Update: expat / python3 (CVE-2024-28757)

The version of expat / python3 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28757 advisory. - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a soft lock in the wifi: rtw89: chan module in the rtw89entityrecalcmgntroles function...

CVE-2025-27110 Libmodsecurity3 has possible bypass of encoded HTML entities

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurit...

CVE-2025-27110 Libmodsecurity3 has possible bypass of encoded HTML entities

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurit...

CVE-2024-55156

An XML External Entity XXE vulnerability in the deserializeArgs method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message...

CVE-2024-49781

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the deserialize method, when handling untrusted XML data, which may contain external entity references. Details XXE Injection is a type of attack against an application that parses XML input. XML is...

CVE-2024-55156

An XML External Entity XXE vulnerability in the deserializeArgs method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message...

CVE-2023-47160

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2024-55156

The Java SDK for CloudEvents (version v4.0.1 ) is vulnerable to an XML External Entity (XXE) Injection within the deserializeArgs() method. When processing untrusted XML data, the parser may dereference external entity references, potentially allowing an attacker to access sensitive local files (...

CloudEvents 安全漏洞

CloudEvents is a Java SDK for CloudEvents open source by CloudEvents. A security vulnerability exists in CloudEvents version v4.0.1, which stems from an XML external entity vulnerability in the deserializeArgs method...

CVE-2024-55156

An XML External Entity XXE vulnerability in the deserializeArgs method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message...

The vulnerability of the task and project management service WEEEK lies in the improper restriction on recursive references to entities in the DTD. This allows a violator to trigger a service failure.

The vulnerability of the WEEEK task and project management service is related to improper restrictions on recursive references to entities in the DTD. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2025-7443 · Unknown · Java Sdk For Cloudevents

Name of the Vulnerable Software and Affected Versions: Java SDK for CloudEvents version 4.0.1 Description: The issue is related to an XML External Entity XXE vulnerability in the deserializeArgs method. This allows attackers to access sensitive information by supplying a crafted XML-formatted eve...