CVE-2024-28982

Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference...

CVE-2024-52807 XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`

The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from...

Security Bulletin: IBM Engineering Lifecycle Management is impacted by vulnerabilities in Apache Jena

Summary A vulnerability has been identified in Apache Jena - jena-core-2.7.1.jar, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions. Vulnerability Details CVEID:CVE-2021-39239 DESCRIPTION: Apache...

PT-2025-2742 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.2.1.12 and earlier Description: An issue was discovered that may allow an attacker to cause a Denial of Service DoS via a crafted XML payload due to an XML External Entity XXE vulnerability...

CVE-2024-40896

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content by setting "checked". This makes classic XXE attacks possible...

UBUNTU-CVE-2024-40896

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content by setting "checked". This makes classic XXE attacks possible...

CVE-2024-40896

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content by setting "checked". This makes classic XXE attacks possible...

CVE-2024-40896

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content by setting "checked". This makes classic XXE attacks possible...

JetBrains TeamCity 代码问题漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A code issue vulnerability exists in JetBrains...

PT-2024-36471 · Chat2Db · Chat2Db

Name of the Vulnerable Software and Affected Versions: Chat2DB version 0.3.5 Description: A vulnerability in the /datagrip/upload component of Chat2DB allows attackers to execute arbitrary code via supplying a crafted XML input, exploiting an XML External Entity XXE injection flaw. Recommendation...

PT-2024-9389 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint affected versions not specified Description: The issue is related to incorrect restriction of XML external entities in Microsoft SharePoint, which can be exploited by a remote attacker to gain unauthorized access to...

Moderate: Red Hat Security Advisory: ACS 4.6 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security RHACS. The updated image includes new features and bug fixes. This release of RHACS 4.6 provides these new features: Support for ARM architecture in secured clusters Technology Preview Certifications for Red Hat Advanced Clust...

The vulnerability of the OMRON CX-Motion Pro controller management program lies in the improper restriction of references to external XML entities (XXE). This allows attackers to access protected information.

The vulnerability of the OMRON CX-Motion Pro controller management program is related to an improper restriction on references to external XML entities XXE. Exploiting this vulnerability may allow a perpetrator to access protected information through a specially created project file...

XML External Entity (XXE) Injection

Overview simplesamlphp/simplesamlphp is a PHP implementation of a SAML 2.0 service provider and identity provider, also compatible with Shibboleth 1.3 and 2.0. Affected versions of this package are vulnerable to XML External Entity XXE Injection due to improper sanitization of XML body in the...

Palo Alto Networks PAN-OS 10.1.x < 10.1.10 / 10.2.x < 10.2.5 / 11.0.x < 11.0.2 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.10 or 10.2.x prior to 10.2.5 or 11.0.x prior to 11.0.2. It is, therefore, affected by a vulnerability. A blind XML External Entities XXE injection vulnerability in the Palo Alto Networks PAN-OS software...

CVE-2024-5919 PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability

A blind XML External Entities XXE injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface...

PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability

A blind XML External Entities XXE injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface. Work aroun...

PT-2024-34533 · Hapi Fhir · Hapi Fhir

Name of the Vulnerable Software and Affected Versions: HAPI FHIR versions prior to 6.4.0 Description: The issue allows attackers to access sensitive information or execute arbitrary code by supplying a crafted request containing malicious XML entities. This is due to an XML External Entity XXE...

CVE-2024-4189

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below...

org.hl7.fhir.core: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r4b: org.hl7.fhir.r5: org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`

A flaw was found in HAPI FHIR - HL7 FHIR Core Artifacts. eXtensible Stylesheet Language Transformations XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...