15 matches found
CVE-2026-115762
draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign...
CVE-2026-115762
The diagramming application draw.io is vulnerable to prototype pollution in its GraphML decoder (mxGraphMlCodec) prior to version 31.1.5 . The root cause is that attacker-controlled GraphML reference keys can target inherited object properties, allowing the decoder to assign malicious attributes ...
CVE-2026-115762 draw.io: Prototype pollution in GraphML (mxGraphMlCodec)
draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign...
PT-2026-137141
draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign...
EUVD-2020-17905
Malware in sbrugna...
CVE-2020-25215
yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document...
PT-2023-19300 · Neo4J · Apoc
Name of the Vulnerable Software and Affected Versions: APOC versions prior to 5.5.0 APOC versions 4.4.0 through 4.4.0.13 Description: A XML External Entity XXE vulnerability was found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. This occurs when the XML parser...
yWorks yEd XXE Vulnerability
yWorks yEd is a graphical editor desktop application. A XXE vulnerability exists in versions prior to yWorks yEd 3.20.1. The vulnerability can be exploited by an attacker to conduct XXE attacks via XML or GraphML documents...
CVE-2020-25215
yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document...
CVE-2020-25215
yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document...
Design/Logic Flaw
yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document...
CVE-2020-25215: Improper Restriction of XML External Entity Reference
yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document...
CVE-2020-25215
The CVE-2020-25215 entry affects yWorks yEd Desktop prior to version 3.20.1 and is caused by an XML External Entity (XXE) vulnerability in XML/GraphML processing. Reported impact indicates XXE could be exploited via crafted documents, enabling unintended access or disclosure consistent with XXE c...
PT-2020-16022 · Yworks · Yed Desktop
Name of the Vulnerable Software and Affected Versions: yWorks yEd Desktop versions prior to 3.20.1 Description: The issue allows XXE attacks via an XML or GraphML document. Recommendations: For versions prior to 3.20.1, update to version 3.20.1 or later to resolve the issue...
