GHSA-G6WM-2V64-WQ36 LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

Description The LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare...

LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

Description The LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service due to jackson-databind package

Summary jackson-databind is used by the DataStage on Cloud Pak for Data ds-runtime service as part of JSON content handling. Vulnerability Details CVEID:CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secure...

BIT-GITLAB-2025-1540 Incorrect Authorization in GitLab

An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances."...

Stable Channel Update for Desktop

The Stable channel has been updated to 134.0.6998.88/.89 for Windows, Mac and 134.0.6998.88 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Extended stable channel has been updated to 134.0.6998.89 for Win/Mac and will roll o...

Amazon Linux 2 : thunderbird (ALAS-2025-2789)

The version of thunderbird installed on the remote host is prior to 128.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2789 advisory. A permission leak could have occurred from a trusted site to an untrusted site via embed or object elements. This...

LocalS3 代码问题漏洞

LocalS3 is a Netty-based implementation of the Amazon S3 service by Luo's personal developer. A code issue vulnerability exists in LocalS3 versions prior to 1.21, which stems from the presence of an XML external entity injection vulnerability that could lead to a server-side request forgery attac...

CVE-2025-0162

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2023-43052

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domai...

CVE-2023-43052

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domai...

CVE-2023-43052 IBM Control Center external service interaction

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domai...

CVE-2023-43052 IBM Control Center external service interaction

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domai...

CVE-2023-43052

IBM Control Center versions 6.2.1–6.3.1 are affected by an External Service Interaction (DNS) vulnerability due to improper input validation. A remote attacker can induce server-side DNS lookups or HTTP requests to arbitrary domains, enabling the app server to contact other systems. The IBM Secur...

Security Bulletin: IBM Sterling Control Center is vulnerable to External Service Interaction (DNS)

Summary External Service Interaction DNS Vulnerability are impacting IBM Sterling control center v6.3.1 and v6.2.1 Vulnerability Details CVEID:CVE-2023-43052 DESCRIPTION: IBM Sterling Control Center is vulnerable to an external service interaction attack, caused by improper validation of...

CVE-2025-0162 IBM Aspera Shares XML external entity injection

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

CVE-2025-0162 affects IBM Aspera Shares 1.9.9–1.10.0 PL7. The issue is an XML External Entity (XXE) injection in XML processing, enabling a remote authenticated attacker to disclose sensitive data or cause memory/resource exhaustion. Root cause: improper handling of external entities in XML. Docu...

CVE-2024-48864 File Station 5

A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers to read/write files or directories. We have already fixed the vulnerability in the following versions: File Station 5...

SUSE CVE-2025-1940

A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. This issue only affects Android versions of Firefox.. This vulnerability was fixed in Firefox 136...