11403 matches found
CVE-2026-1227
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...
CVE-2026-1227
CVE-2026-1227 describes an XML External Entity (XXE) vulnerability (CWE-611) in which a local user uploading a specially crafted TGML graphics file to the EBO server from Workstation could trigger unauthorized disclosure of local files, unintended interaction within the EBO system, or denial of s...
CVE-2026-1227
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...
MAL-2026-854 Malicious code in sinon-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c9ac1d9ff3647908703db921b2e950e479861f18e7b1bad8377baaa7400d32c The package sinon-node was found to contain malicious code. Source: ghsa-malware 5aa93130bd1915120b30dc2472c774ac984ea2c2166d7865d30fdf8343225f50 Any...
USN-8023-1: xmltok library vulnerabilities
It was discovered that Expat, contained within the xmltok library, incorrectly handled the initialization of parsers for external entities. An attacker could possibly use this issue to cause a denial of service. CVE-2026-24515 It was discovered that Expat, contained within the xmltok library,...
USN-8023-1 libxmltok vulnerabilities
It was discovered that Expat, contained within the xmltok library, incorrectly handled the initialization of parsers for external entities. An attacker could possibly use this issue to cause a denial of service. CVE-2026-24515 It was discovered that Expat, contained within the xmltok library,...
XML external entity injection vulnerability in IBM Business Automation Workflow containers and IBM Business Automation Workflow traditional
IBM Business Automation Workflow is a suite of workflow automation solutions from International Business Machines IBM. The product is primarily used for workflow management, compliance management, and features workflow visibility and scalability. IBM Business Automation Workflow containers V25.0....
CVE-2020-37192: Improper Restriction of XML External Entity Reference
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system...
Top Password MSN Password Recovery 代码问题漏洞
Top Password MSN Password Recovery is a MSN password recovery tool developed by Top Password Inc. Version 1.30 of Top Password MSN Password Recovery has a code vulnerability that stems from XML external entity injection, which may lead to the reading of local system files...
PT-2026-7690
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system...
PT-2026-7582
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...
Schneider Electric EcoStruxure Building Operation Workstation 代码问题漏洞
Schneider Electric EcoStruxure Building Operation Workstation is a specialized operational terminal component developed by Schneider Electric, a French company. There is a code vulnerability in the Schneider Electric EcoStruxure Building Operation Workstation. This vulnerability stems from improp...
CVE-2026-1227: Improper Restriction of XML External Entity Reference
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...
Vulnerability of the ManifestParser and AmazonS3 classes in the Git version control system for the Java Eclipse JGit language, allowing attackers to perform XXE attacks
The vulnerability of the ManifestParser and AmazonS3 classes in the Git version control system, implemented in the Java Eclipse JGit framework, is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attack...
The vulnerability of the org.assertj.core.util.xml.XmlStringPrettyFormatter component in the Java library for writing assertions in module tests in AssertJ allows attackers to perform XXE attacks.
The vulnerability in the org.assertj.core.util.xml.XmlStringPrettyFormatter component of the Java library for writing assertions in module tests within AssertJ is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow attackers to perfo...
USN-8022-1: Expat vulnerabilities
It was discovered that Expat incorrectly handled memory when parsing certain XML files. An attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 25.10. CVE-2025-59375 It was discovered that Expat incorrectly handled the initialization of...
Security Bulletin: Due to the use of Apache Tika, IBM webMethods Integration Server is vulnerable to XML External Entity injection (CVE-2025-66516)
Summary IBM webMethods Integration Server uses Apache Tika for Reference Data functionality and vulnerability reported in Apache Tika is addressed. Vulnerability Details CVEID:CVE-2025-66516 DESCRIPTION: Critical XXE in Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1 and tika-parser...
CLSA-2026-1770707507 Fix CVE(s): CVE-2026-24515
SECURITY UPDATE: Make XMLExternalEntityParserCreate copy unknown encoding handler user data - debian/patches/CVE-2026-24515.patch: copy unknown encoding handler user data and add tests to cover effect - CVE-2026-24515...
Apache Syncope Code Issue Vulnerability
Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope there is a code problem vulnerability , the vulnerability...