CVE-2024-35532

An XML External Entity (XXE) injection vulnerability exists in Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14 . This flaw allows an attacker to perform arbitrary file reading under the privileges of the running process, initiate SSRF requests , or trigger a Denial of Service (DoS) via...

CVE-2024-46603

An XML External Entity XXE vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service DoS via a crafted XML payload...

CVE-2024-46602

An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity XXE vulnerability may allow an attacker to cause a Denial of Service DoS via a crafted XML payload...

PT-2025-2743 · Elspec Engineering · Elspec Engineering G5 Digital Fault Recorder Firmware

Name of the Vulnerable Software and Affected Versions: Elspec Engineering G5 Digital Fault Recorder Firmware version 1.2.1.12 Description: The issue is related to an XML External Entity XXE vulnerability, which allows attackers to cause a Denial of Service DoS via a crafted XML payload. This...

CVE-2024-46602

An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity XXE vulnerability may allow an attacker to cause a Denial of Service DoS via a crafted XML payload...

CVE-2024-46602

An XML External Entity (XXE) vulnerability exists in Elspec G5 digital fault recorder version 1.2.1.12 and earlier . A remote attacker could exploit this flaw by submitting a crafted XML payload to trigger a Denial of Service (DoS) . As a temporary workaround, it is recommended to disable the pro...

Elspec G5 Digital Fault Recorder code-related vulnerabilities

Elspec G5 Digital Fault Recorder is a digital fault recorder from Elspec, Israel. It is used to monitor and record fault events and waveform data in power systems. A security vulnerability exists in Elspec G5 Digital Fault Recorder version 1.2.1.12 and prior versions, which stems from the presenc...

Elspec G5 Digital Fault Recorder code-related vulnerabilities

Elspec G5 Digital Fault Recorder is a digital fault recorder from Elspec, Israel. It is used to monitor and record fault events and waveform data in power systems. A security vulnerability exists in Elspec G5 Digital Fault Recorder version 1.2.1.12 and prior versions, which stems from the presenc...

Intersec Geosafe-ea buffer error vulnerability

Intersec Geosafe-ea is an application from Intersec France. A security vulnerability exists in Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14, which stems from the presence of an XML External Entity Injection vulnerability that could allow an attacker to perform an arbitrary file read...

USN-7180-1 python2.7 vulnerabilities

It was discovered that Python incorrectly handled certain scripts. An attacker could possibly use this issue to execute arbitrary code or cause a crash. CVE-2022-48560 It was discovered that Python did not properly handle XML entity declarations in plist files. An attacker could possibly use this...

USN-7180-1: Python vulnerabilities

It was discovered that Python incorrectly handled certain scripts. An attacker could possibly use this issue to execute arbitrary code or cause a crash. CVE-2022-48560 It was discovered that Python did not properly handle XML entity declarations in plist files. An attacker could possibly use this...

XML External Entity (XXE) Injection

simplesamlphp is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of untrusted XML input, which allows attackers to exploit maliciously crafted XML documents, such as SAMLResponse, to access sensitive information or perform other malicious activities...

PT-2025-20233

Name of the Vulnerable Software and Affected Versions SysAid On-Prem versions 23.3.40 and earlier Description SysAid On-Prem software is affected by an unauthenticated XML External Entity XXE issue in the lshw processing functionality. Exploitation of this issue may allow a remote attacker to tak...

Ubuntu 20.04 LTS / 22.04 LTS : Python vulnerabilities (USN-7180-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7180-1 advisory. It was discovered that Python incorrectly handled certain scripts. An attacker could possibly use this issue to execute arbitrary code or cau...

PT-2025-20134

Name of the Vulnerable Software and Affected Versions SysAid On-Prem versions 23.3.40 and earlier Description SysAid On-Prem is affected by an unauthenticated XML External Entity XXE issue in the Server URL processing functionality. This allows for administrator account takeover and file read...

CVE-2024-56322

GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 inclusive can allow GoCD admins to abuse a hidden/unused configuration repository pipelines as code feature to allow XML External Entity XXE injection on the GoCD Server which will be executed when GoCD periodically scans...

CVE-2024-56324

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

CVE-2024-56324 GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

CVE-2024-56324

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

CVE-2024-56322 GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality

GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 inclusive can allow GoCD admins to abuse a hidden/unused configuration repository pipelines as code feature to allow XML External Entity XXE injection on the GoCD Server which will be executed when GoCD periodically scans...