105 matches found
CVE-2026-48089
DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create,...
The vulnerability of the ColdFusion interpreter arises from incorrect restrictions on XML references to external objects, allowing attackers to gain unauthorized access to protected information.
The vulnerability of the ColdFusion interpreter is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
GHSA-RM4C-XJ6X-49MW Gotenberg has a Server-Side Request Forgery (SSRF) Issue
Summary The SSRF hardening shipped in v8.31.0 only covers outbound URLs that Gotenberg's Go code handles — Chromium asset fetches, webhook delivery, and download-from. The LibreOffice conversion endpoint /forms/libreoffice/convert passes uploaded documents directly to LibreOffice without inspecti...
CVE-2026-1669
Arbitrary file read in the model loading mechanism HDF5 integration in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references...
GHSA-69F9-5GXW-WVC2
creationtimestamp| type| source ---|---|--- 2026-01-06 00:03:31+00:00| published-proof-of-concept| Telegram/pBIBejJY22UGYFBeCviRWB0sbqSJQWVhrb4WN5JzMLlOPk 2026-01-24 21:31:05+00:00| seen| https://gist.github.com/alon710/d933cf1d26a86bd97e8178c2f7cb58d2 2026-01-24 21:31:06+00:00| seen|...
The vulnerability of the ColdFusion software platform lies in the improper limitation of XML references to external objects, which allows attackers to disclose protected information.
The vulnerability of the ColdFusion software platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...
The vulnerability of the ColdFusion software platform lies in the improper limitation of XML references to external objects, which allows attackers to disclose protected information.
The vulnerability of the ColdFusion software platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...
CVE-2025-34282
ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...
ROS-20250908-01
A vulnerability in the Expat XML parsing library is related to incorrect restriction of XML references to external objects. Exploitation of the vulnerability could allow a remote attacker to gain access to sensitive data, compromise its integrity, and cause a denial of service. sensitive data,...
defusedxml
This is a Python library called defusedxml, which is designed to prevent XML bomb denial of service DoS vulnerabilities. The library provides a facade for the xml.etree.ElementTree module, which is a built-in Python module for parsing and creating XML documents. The library is maintained by...
The vulnerability of the Dell EMC AppSync data storage and protection software lies in improper restrictions on XML references to external objects, which allows attackers to disclose protected information.
The vulnerability of the Dell EMC AppSync data storage and protection software is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow an attacker to disclose protected information...
ROS-20250825-02
A vulnerability in the Nokogiri program library of the Ruby interpreter is related to improper handling of an an unexpected data type. Exploitation of the vulnerability could allow an attacker, acting remotely, disclose protected information or cause a denial of service A vulnerability in the...
The vulnerability of the IBM QRadar SIEM system’s event collection and analysis process is related to incorrect restrictions on XML links to external objects, which allows unauthorized access to protected information.
The vulnerability of the IBM QRadar SIEM event collection and analysis system is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using a...
The vulnerability of the FastReport.NET report and document generation library lies in the improper limitation of XML references to external objects. This allows attackers to gain unauthorized access to files and perform SSRF attacks.
The vulnerability of the FastReport.NET report and document generation library is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to files and perform a SSRF attack...
The vulnerability of the ColdFusion software platform lies in the improper limitation on XML references to external objects, which allows attackers to circumvent security restrictions.
The vulnerability of the ColdFusion software platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...
The vulnerability of the ColdFusion software platform lies in the improper limitation on XML references to external objects, which allows attackers to circumvent security restrictions.
The vulnerability of the ColdFusion software platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...
The vulnerability of Dell Storage Manager’s cluster management software lies in the improper limitation of XML references to external objects, which allows attackers to exploit this flaw to disclose protected information.
The vulnerability of Dell Storage Manager’s cluster management software relates to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...
SpeechVerifier: Robust Acoustic Fingerprint against Tampering Attacks Via Watermarking
With the surge of social media, maliciously tampered public speeches, especially those from influential figures, have seriously affected social stability and public trust. Existing speech tampering detection methods remain insufficient: they either rely on external reference data or fail to be bo...
The software for creating automation projects of Schneider Electric’s Web Designer network modules BMXNOE0110H, BMENOC0311C, BMENOC0321C, and BMXNOR0200H is vulnerable due to incorrect restrictions on XML references to external objects. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the software used for creating automation projects in Schneider Electric’s Web Designer for network modules BMXNOE0110H, BMENOC0311C, BMENOC0321C, and BMXNOR0200H is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows ...
The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server programs lies in the improper limitation of XML references to external objects, which allows attackers to gain unauthorized access to protected information.
The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow an attacker to gain unauthorized acces...