CVE-2019-19144: Improper Restriction of Recursive Entity References in DTDs

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 11449-53631 Build304 devices via rest/Users?action=authenticate...

PT-2025-31644 · Quantum · Quantum Dxi6702

Name of the Vulnerable Software and Affected Versions: Quantum DXi6702 version 2.3.0.3 11449-53631 Build304 Description: An XML External Entity Injection issue exists in Quantum DXi6702 devices. The vulnerability is located in the /rest/Users?action=authenticate API endpoint. Recommendations: At...

CVE-2019-19144

The Quantum DXi6702 disk backup and deduplication appliance (version 2.3.0.3 (11449-53631 Build304) ) is vulnerable to an XML External Entity (XXE) Injection vulnerability. The flaw exists in the /rest/Users?action=authenticate API endpoint due to improper restrictions on XML links to external ob...

GHSA-QC2H-74X3-4V3W MaterialX Lack of MTLX Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion

Summary Nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. Details The MaterialX specification supports importing other files by using XInclude tags. When parsing file imports, recursion is used to process...

GHSA-WX6G-FM6F-W822 MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit

Summary When parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. Details By specification, multiple kinds of elements in MTLX support nesting other elements, such as in the case of nodegraph elements...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the XML parsing process. An attacker can cause a crash by providing a specially crafted MTLX file with deeply nested nodegraph elements, leading to stack exhaustion during recursive parsing. Remediation...

MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit

Summary When parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. Details By specification, multiple kinds of elements in MTLX support nesting other elements, such as in the case of nodegraph elements...

libxslt: libxml2: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may acce...

CVE-2025-26400

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...

libxslt: Type confusion in xmlNode.psvi between stylesheet and source nodes

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of...

ALSA-2025:12447 Important: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxslt: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr CVE-2025-7425 For more details about the security issues, including the impact, a CVSS score,...

ALSA-2025:12450 Important: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxslt: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr CVE-2025-7425 For more details about the security issues, including the impact, a CVSS score,...

VulnCheck KEV: CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection...

PT-2025-31590

Name of the Vulnerable Software and Affected Versions MaterialX versions 1.39.2 and below Description MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. The MaterialX XML parsing logic can potentially crash due to stack...

CVE-2014-125125: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit...

CVE-2025-36608

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2025-36608

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2025-36608

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2025-36608

CVE-2025-36608 affects Dell SmartFabric OS10 Software prior to 10.6.0.5. The issue is an improper restriction of XML External Entity references in OS10, enabling a low-privileged, remote attacker to potentially gain unauthorized access. Impact is described as unauthorized access with Network atta...

CVE-2025-36608

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...