PT-2024-40074

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.11.13 and 1.12.0 Description: The issue concerns the insecure usage of PHP's DOM extension in Zend Feed Rss and Zend Feed Atom, allowing for potential XML eXternal Entity XXE vectors. This could be exploited...

Improper validation of intent data received in TextViewerActivity allows opening of arbitrary files in hamza417/inure

Description Tested on Build89 of the Inure application. It was discovered that the application had an exported activity .activities.association.TextViewerActivity which accepted intent data via the file scheme + text/ mime type and opened the associated files from provided URI data string. The...