10082 matches found
CVE-2019-25253 KYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity Injection
KYOCERA Net Admin 3.4.0906 contains an XML External Entity XXE injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers to read arbitrary system files. Attackers can craft a malicious XML file with external entity references to retrieve sensitive configuratio...
CVE-2018-25142 NovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection
NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity XXE injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack...
CVE-2018-25142
NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 is affected by an unauthenticated XML External Entity (XXE) injection in XML preference import settings. The root cause is an XXE vulnerability that allows crafted XML files with DTD parameter entities to retrieve arbitrary system files via an out-of-...
CVE-2018-25142 NovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection
NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity XXE injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack...
Exploit for Improper Restriction of XML External Entity Reference in Wordpress
TryHackMe Writeups and Walkthroughs This repository contains...
CVE-2024-58335
OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java...
OpenXRechnungToolbox 代码问题漏洞
OpenXRechnungToolbox is a graphical user interface for visualizing and validating electronic invoices by Dr. Jan C. Thiele Personal Developer. A code issue vulnerability exists in OpenXRechnungToolbox version 2024-10-05-3.0.0 up to and including 6c50e89, which stems from the disallow-doctype-decl...
CVE-2024-58335
OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java...
KYOCERA Net Admin 安全漏洞
KYOCERA Net Admin is an enterprise-level device management platform from KYOCERA, Inc. A security vulnerability exists in KYOCERA Net Admin version 3.4.0906, which stems from the mishandling of XML files by the Multi-Set Template Editor, which could lead to an XML external entity injection attack...
PT-2025-53362
NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity XXE injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack...
CVE-2024-58335
OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java...
PT-2025-53339
Name of the Vulnerable Software and Affected Versions KYOCERA Net Admin version 3.4.0906 Description KYOCERA Net Admin 3.4.0906 contains an XML External Entity XXE injection issue in the Multi-Set Template Editor. This allows unauthenticated attackers to read arbitrary system files. Attackers can...
CVE-2024-58335
OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java...
NovaRad NovaPACS Diagnostics Viewer 安全漏洞
NovaRad NovaPACS Diagnostics Viewer is a medical imaging diagnostics viewer from NovaRad Philippines. A security vulnerability exists in NovaRad NovaPACS Diagnostics Viewer version 8.5.19.75, which stems from an XML preferences import that has XML external entity injection, which could lead to...
SUSE CVE-2025-68463
Bio.Entrez in Biopython through 186 allows doctype XXE...
Security Bulletin: Multiple Vulnerabilities in IBM StreamSets Data Collector
Summary Multiple vulnerabilities were addressed in IBM StreamSets Data Collector version 7.0.0 Vulnerability Details CVEID:CVE-2019-10202 DESCRIPTION: A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485,...
Malicious code in tiny-model-update (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a69a5156f95b3b1ddd3a9c0ddd7e1fad0cdd92841e56dc6ea7b950a35a5eb34 The package tiny-model-update was found to contain malicious code. Source: ghsa-malware...
XXE (XML External Entity Injection) in Crowd Data Center and Server
This High severity XXE XML External Entity Injection vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE XML External Entity Injection vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high...
Malicious code in ctfparsertna (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52cd5612214cb1fd0ed34899c5e686c4fdbecb4a820e170a3589987c20b9b3da The package ctfparsertna was found to contain malicious code. Source: ghsa-malware 90b9a48b58422c5d9853769c983bd04388558c312be191e3bfd8a82158214d38 A...