Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

EUVD-2026-125349

In Eclipse AAS4J before 3.0.1, XmlSchemaValidator.validateSchema and AASXValidator.validateSchema, which calls it validates untrusted XML with a default JAXP Validator that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read...

PT-2026-146889

In Eclipse AAS4J before 3.0.1, XmlSchemaValidator.validateSchema and AASXValidator.validateSchema, which calls it validates untrusted XML with a default JAXP Validator that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read...

Adobe Connect XML External Entity File Read

The software vulnerability in Adobe Connect for web conferencing involves improper restriction of XML references to external objects. Exploitation of this vulnerability may allow a remote attacker to read arbitrary files...

CVE-2026-88789

A flaw was found in Apache Camel Quarkus. The XML transformation support extension configures a transformer that fails to enforce restrictions on external entities and stylesheets. A remote attacker can exploit this vulnerability by submitting a specially crafted XML document during transformatio...

CVE-2026-123029

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process...

CVE-2026-123029

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process...

CVE-2026-123029

The Wowza Streaming Engine version before 4.12.2 is vulnerable to an XML external entity (XXE) injection. An unhandled processing of external entities allows remote attackers to read local files with the same privileges as the Wowza Streaming Engine process. No specific exploit links or remediati...

EUVD-2026-117386

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process...

CVE-2026-123029

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process...

PT-2026-137418

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine versions prior to 4.12.2 Description The software processes XML external entities, which enables remote attackers to read local files using the privileges of the Wowza Streaming Engine process. This issue involves XML...

Safir input validation error vulnerability in the National Accounting Office

The input validation error vulnerability exists in Szafir 2.0.0 and earlier versions, as well as Szafir Weryfikująca 1.0 and earlier versions. This vulnerability stems from the parser’s handling of external entities when processing specially crafted XML files containing external DTD references to...

Tactis NoviGest Desktop App input validation error vulnerability

The Tactis NoviGest Desktop App versions prior to 8.0.0-300 contain an input validation error vulnerability. This vulnerability arises because the SAFT import functionality fails to properly disable external entity resolution when processing XML files controlled by users via JAXB Unmarshaller. As...

Apache Camel input validation error vulnerability

Security vulnerabilities exist in Apache Camel versions 4.0.0 through 4.18.5 and 4.19.0 through 4.22.2. These stem from the XQueryBuilder in camel-saxon, which uses the default Saxon Configuration to parse stream-based Source message bodies. No restrictions are placed on DOCTYPE declarations or...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.7.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability stems from improper restrictions on external entities by the camel-smooks component. The default XML parser allows for the parsing of external...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation. This vulnerability arises when the FopProducer creates a TransformerFactory by enabling only FEATURESECUREPROCESSING, without restricting access to external resources...

IBM MQ 9.1 < 9.1.0.38 LTS / 9.2 < 9.2.0.44 LTS / 9.3 < 10.0.0.5 CD / 9.3 < 9.3.0.42 LTS / 9.4 < 9.4.0.26 LTS (7284936)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7284936 advisory. - IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 throug...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / etc (crlsa-2022_7470)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227470 advisory. pki-core: access to external entities when parsing XML can lead to XXE CVE-2022-2414 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: pki-acme / pki-base / pki-base-java / pki-ca / pki-kra / pki-server / etc (crlsa-2022_7326)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227326 advisory. pki-core: access to external entities when parsing XML can lead to XXE CVE-2022-2414 Tenable has extracted the preceding description block directly from the CIQ...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Expat vulnerabilities (USN-8813-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8813-1 advisory. It was discovered that Expat did not correctly handle certain integer arithmetic...