SAP Internet Graphics Server (IGS) - XML External Entity Injection

SAP Internet Graphics Servers IGS running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag...

GeoServer - XML External Entity Injection

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity XXE injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input. id: CVE-2025-58360 info: name: GeoServer - XM...

Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection. id: CVE-2025-49493 info: name: Akamai CloudTest 60 2025.06.02 - XML External Entity XXE author: xbow,3th1cyuk1 severity: critical description: | Akamai CloudTest before 60 2025.06.02 12988...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

Oracle Business Intelligence Publisher - XML External Entity Injection

Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publishe...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...

[SECURITY] [DSA 6617-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6617-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 09, 2026 https://www.debian.org/security/faq -...

CVE-2026-13284

IBM MQ is vulnerable to an XML external entity injection (XXE) attack within the Managed File Transfer component when processing XML data. This vulnerability (CWE-611) could allow a remote attacker to expose sensitive information or consume memory resources. Affected versions include IBM MQ 9.2.0...

EUVD-2026-117069

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this...

CVE-2026-13284 IBM MQ Managed File Transfer is vulnerable to XML external entity injection

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this...

CVE-2026-13289

IBM MQ Managed File Transfer is vulnerable to an XML external entity injection (XXE) attack (CWE-611) when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources . Affected versions include IBM MQ 9.2.0.0 to 9.2.0.44 LTS...

CVE-2026-13289 IBM MQ Managed File Transfer is vulnerable to XML external entity injection

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this...

Ubuntu 16.04 LTS / 20.04 LTS : Yaws vulnerabilities (USN-8995-1)

The remote Ubuntu 16.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8995-1 advisory. It was discovered that Yaws did not properly sanitize XML input in its WebDAV implementation. A remote attacker could possibly use this issue...

USN-8995-1: Yaws vulnerabilities

It was discovered that Yaws did not properly sanitize XML input in its WebDAV implementation. A remote attacker could possibly use this issue to perform XML external entity injection attacks. CVE-2020-24379 It was discovered that Yaws mishandled certain input when running CGI scripts. A remote...

Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13284)

Summary IBM MQ Managed File Transfer has addressed an XML external entity injection vulnerability Vulnerability Details CVEID:CVE-2026-13284 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerabilit...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-65432)

Summary IBM MQ has addressed an XML External Entity Injection vulnerability in IBM WebSphere Application Server Liberty Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities...

Kitodo.Production 3.9.1 XML External Entity Injection

Kitodo.Production versions before 3.9.2 contain an XML external entity injection vulnerability in XMLUtils EAD imports. The proof of concept demonstrates local file disclosure through external entity resolution. https://packetstorm.news/download/237414...

Kitodo.Production input validation error vulnerability

Versions prior to Kitodo.Production 3.9.2 contain an input validation error vulnerability. This vulnerability arises because XML parsing helper methods use default insecure configurations to build JAXP parsers, without disabling DOCTYPE declarations or external entity resolution. As a result, the...

Apache Camel 4.22.0 XML External Entity Injection

Apache Camel camel-smooks versions from 4.7.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an XML external entity issue. The proof of concept demonstrates resolution of a self-created temporary marker file during XML unmarshalling. https://packetstorm.news/download/236738...

Apache jclouds 2.7.0 XML External Entity Injection

Apache jclouds version 2.7.0 contains an XML External Entity injection vulnerability in provider-response parsing that may allow local file disclosure or server-side request forgery when a parsed endpoint is attacker controlled. !/usr/bin/env bash Apache jclouds 2.7.0 XML External Entity XXE...