CVE-2025-31487: Improper Restriction of XML External Entity Reference

The XWiki JIRA extension provides various integration points between XWiki and JIRA macros, UI, CKEditor plugin. If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a...

PT-2025-13522 · W3Css · W3Css Validator

Name of the Vulnerable Software and Affected Versions: W3CSS Validator versions before cssval-20250226 Description: The issue is related to an XXE XML External Entity attack in the W3CSS Validator, which allows an attacker to use specially-crafted XML objects to coerce server-side request forgery...

JetBrains GoLand Code Issue Vulnerability

JetBrains GoLand is a set of intelligent IDE Integrated Development Environment dedicated to Go language development from the Czech company JetBrains. A code issue vulnerability exists in JetBrains GoLand that stems from a networked system or product that does not have the correct filters set up ...

Security Bulletin: IBM Security Verify Directory products have multiple security vulnerabilities (CVE-2022-33164, CVE-2022-33168, CVE-2022-33161, CVE-2022-32755)

Summary Several vulnerabilities have been addressed in IBM Security Directory Server, IBM Security Directory Suite, and IBM Security Verify Directory products. Vulnerability Details CVEID:CVE-2022-33164 DESCRIPTION: IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse...

Security Bulletin: Financial Transaction Manager for Digital Payments, High Value Payments and Corporate Payment Services are impacted by multiple vulnerabilities.

Summary The vulnerabilities addressed include access control, sensitive information disclosure, cross site scripting and directory traversal. Vulnerability Details CVEID:CVE-2020-5002 DESCRIPTION: IBM Financial Transaction Manager could allow an authenticated user to perform unauthorized actions...

CVE-2025-29932

In JetBrains GoLand before 2025.1 an XXE during debugging was possible...

Malicious code in blockzie-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3209d64326bd799c5863c01555419390a8c7b7973fa38222b434cea7838b6f81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-25036

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

CVE-2025-25036 Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

CVE-2025-25036 Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

CVE-2025-25036

Jalios JPlatform is affected by CVE-2025-25036 (XML External Entity Reference leading to XML Injection) in all versions prior to 10.0.8 (SP8). The issue is due to improper restriction of external entities, enabling XML injections under network access. Reported impact focuses on confidentiality ri...

Jalios JPlatform security vulnerabilities

Jalios JPlatform is a digital work platform from Jalios, Inc. A security vulnerability exists in Jalios JPlatform versions prior to 10.0.8, which stems from an improperly restricted XML external entity reference that could lead to XML injection...

CVE-2025-25036: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

PT-2025-12441

Name of the Vulnerable Software and Affected Versions Jalios JPlatform versions prior to 10.0.8 SP8 Description The issue is related to an Improper Restriction of XML External Entity Reference vulnerability, which allows XML Injection. Recommendations For versions prior to 10.0.8 SP8, update to...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

CVE-2025-2365

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

Malicious code in pendeck (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52144cad81187f6ac538b8ed921e0d500b9094449083bb6f7d408e5e7b6ba2d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

yimioa security vulnerabilities

yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in versions prior to yimioa v2024.07.04, which stems from the presence of XML external entity injection in the XMLParse component, which allows an attacker to execute arbitrary co...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...