1039 matches found
PT-2025-39675
Name of the Vulnerable Software and Affected Versions Jinher OA version 2.0 Description A flaw exists in Jinher OA 2.0 that allows for xml external entity reference. This issue is related to an unknown function within the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl=1. The atta...
CVE-2025-10816
A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl=add of the component XML Handler. Performing manipulation results in xml external entity reference. The attack may be initiated remotely...
K000156606: libxml2 vulnerability CVE-2025-27113
Security Advisory Description libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. CVE-2025-27113 Impact This vulnerability allows an attacker to cause a denial-of-service DoS on the system. Security Advisory Status F5 Product Development has...
Jinher OA 代码问题漏洞
Jinher OA is a collaborative management software from Jinher, China. A code issue vulnerability exists in Jinher OA version 2.0, which stems from incorrect operation of the XML processing component in file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx, which could lead to an XML external...
CVE-2025-58748
Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation H2.java does not verify that a provided JDBC URL starts with jdbc:h2. This lack of validation allows a crafted JDBC configuration that substitutes the Amazon...
REXML 资源管理错误漏洞
REXML is a Ruby open source XML toolkit for Ruby. A resource management error vulnerability exists in REXML versions 3.3.3 through 3.4.1, which stems from mishandling when parsing XML containing multiple XML declarations, and could lead to a denial of service attack...
CVE-2025-59375
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing...
Exploit for Unprotected Alternate Channel in Crushftp
CVE-2025-54309 - CrushFTP Affected Versions - 10.8.5 -...
Linux Distros Unpatched Vulnerability : CVE-2024-39126
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. CVE-2024-39126 Note that Nessus relies on the presence of the package as reported...
CVE-2025-10183
A blind XML External Entity XXE injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCo...
Jinher OA 代码问题漏洞
Jinher OA is a collaborative management software from Jinher, China. A code issue vulnerability exists in Jinher OA 1.2 and earlier versions, which originates from an XML external entity reference vulnerability in the /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx file...
Jinher OA 代码问题漏洞
Jinher OA is a collaborative management software from Jinher, a Chinese company. A code issue vulnerability exists in Jinher OA 1.2 and prior versions, which arises from the presence of XML external entity references in the XML Handler component...
SUSE CVE-2025-9375
XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator,...
CVE-2025-57704
Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability...
PT-2025-34746
Name of the Vulnerable Software and Affected Versions: Delta Electronics EIP Builder version 1.11 Description: Delta Electronics EIP Builder version 1.11 is susceptible to a file parsing XML External Entity XXE processing information disclosure issue. This allows for the potential disclosure of...
Linux Distros Unpatched Vulnerability : CVE-2016-4570
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service stack consumption via crafted...
CVE-2022-45133
Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A particularly structured XML file could allow one to traverse the server to obtain access to secure files or cause code execution based on the payload...
CVE-2025-47184
An XML external entities XXE injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve information disclosure and privilege escalation via a crafted ISys XML message...
Linux Distros Unpatched Vulnerability : CVE-2017-14687
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to Data from Faultin...
