PT-2025-20134

Name of the Vulnerable Software and Affected Versions SysAid On-Prem versions 23.3.40 and earlier Description SysAid On-Prem is affected by an unauthenticated XML External Entity XXE issue in the Server URL processing functionality. This allows for administrator account takeover and file read...

PT-2025-20233

Name of the Vulnerable Software and Affected Versions SysAid On-Prem versions 23.3.40 and earlier Description SysAid On-Prem software is affected by an unauthenticated XML External Entity XXE issue in the lshw processing functionality. Exploitation of this issue may allow a remote attacker to tak...

Ubuntu 20.04 LTS / 22.04 LTS : Python vulnerabilities (USN-7180-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7180-1 advisory. It was discovered that Python incorrectly handled certain scripts. An attacker could possibly use this issue to execute arbitrary code or cau...

CVE-2024-56324

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

CVE-2024-56322

GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 inclusive can allow GoCD admins to abuse a hidden/unused configuration repository pipelines as code feature to allow XML External Entity XXE injection on the GoCD Server which will be executed when GoCD periodically scans...

CVE-2024-56324 GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

CVE-2024-56322 GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality

GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 inclusive can allow GoCD admins to abuse a hidden/unused configuration repository pipelines as code feature to allow XML External Entity XXE injection on the GoCD Server which will be executed when GoCD periodically scans...

GoCD 代码问题漏洞

GoCD is a continuous delivery server for GoCD open source. A code issue vulnerability exists in GoCD versions 16.7.0 through 24.4.0 that stems from an XML External Entity XXE injection vulnerability that allows abuse of the hidden/unused Configuration Repository feature...

PT-2025-1144 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions prior to 24.4.0 Description: The issue is related to the incorrect restriction of XML external entity references in GoCD, a continuous delivery server. This can allow "group admins" to abuse the ability to edit raw XML...

PT-2025-1150 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions 16.7.0 through 24.4.0 Description: The issue is related to an XML External Entity XXE injection vulnerability in the GoCD server, which can be exploited by a remote attacker. This vulnerability is associated with the incorrect...

GoCD 代码问题漏洞

GoCD is an open source continuous delivery server from GoCD. A code issue vulnerability exists in GoCD versions prior to 24.5.0 that stems from allowing abuse of the ability to edit raw XML configurations, which triggers an XML External Entity XXE injection vulnerability...

CVE-2024-56322: Improper Restriction of XML External Entity Reference

GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 inclusive can allow GoCD admins to abuse a hidden/unused configuration repository pipelines as code feature to allow XML External Entity XXE injection on the GoCD Server which will be executed when GoCD periodically scans...

PT-2025-49782

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the drm/sched subsystem related to a potential deadlock within the drm sched entity kill jobs cb function. The issue arises when handling dependencies...

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

...

DEBIAN-CVE-2024-56583

In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix warning in migrateenable for boosted tasks When running the following command: while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done a warning is eventually triggered: WARNING: CPU: 43 PID...

UBUNTU-CVE-2024-56551

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free +0.000021 BUG: KASAN: slab-use-after-free in drmschedentityflush+0x6cb/0x7a0 gpusched +0.000027 Read of size 8 at addr ffff8881b8605f88 by task amdpciunplug/2147 +0.000023 CPU: 6 PID: 2147...

MAL-2024-12150 Malicious code in kubehook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b24e2f8ec8704648d97708660341e0d666f21957c858f73fe3ac792df4b2024f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12139 Malicious code in casino-luzern-easter-fronten (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9657421a13075a125eb2aaf87ac5a9a905e170cc658ec3669ce78bcc359327b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12149 Malicious code in js-dos-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d534d9ec05d6809f40b3db232c0e24e612234ca30b7d46155b7aa6043c7d02a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML External Entity (XXE) Injection

org.fhir, ucum is vulnerable to XML External Entity XXE Injection. The vulnerability is due to XML parsing performed by the UcumEssenceService, which allows a malicious DTD tag in the XML to inject data from the host system...