CData Sync < 23.4.8843 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Sync CData - Sync' - r...

CData API Server < 23.4.8844 - Path Traversal

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31848 info: name: CData API Server...

CData Arc < 23.4.8839 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions. id: CVE-2024-31850 info: name: CData Arc 23.4.88...

CData RSB Connect v22.0.8336 - Server Side Request Forgery

CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery SSRF. id: CVE-2023-24243 info: name: CData RSB Connect v22.0.8336 - Server Side Request Forgery author: ritikchaddha severity: high description: | CData RSB Connect v22.0.8336 was discovered to contain a...

CVE-2024-31848-PoC

Exploiting CData within Jetty servers - CVE-2024-31848/49/50/51 - File Path Traversal & File Read What it is A prototype PoC for the automation of vulnerability analysis on targets running CData applications on an embedded Jetty server. Usage Just use -u or --url to specify your target, the scrip...

CVE-2020-12625

CVE-2020-12625: Cross-Site Scripting mediante adjunto HTML malicioso en Roundcube Webmail Existe una vulnerabilidad de Cross-Site Scripting XSS en las versiones de Roundcube anteriores a 1.4.4, 1.3.11 y 1.2.10. Al aprovechar el elemento XML "" en un correo con un adjunto "text/html", un atacante...

[SECURITY] [DLA 4765-1] expat security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4765-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura August 31, 2026 https://wiki.debian.org/LTS -...

Debian dla-4765 : expat - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4765 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4765-1 [email protected]...

CVE-2026-12717

An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in...

CVE-2026-12717 Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection

An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in...

CVE-2026-12717

CVE-2026-12717 is an Improper Input Validation vulnerability in the CData JDBC driver integration within Google Cloud BigQuery Data Transfer Service (versions prior to 2026-05-01). An authenticated attacker can achieve remote code execution in the connector container and escalate privileges in th...

EUVD-2026-66420

An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in...

PT-2026-82091

Name of the Vulnerable Software and Affected Versions Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 Description Improper input validation in the CData JDBC driver integration allows an authenticated attacker to achieve remote code execution within the connector containe...

Astra Linux – Vulnerability in ruby-loofah

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.2.0; versions before 2.19.1 use recursion to sanitize CDATA sections, which can lead to stack exhaustion and raise a SystemStackError exception. This may result in ...

CVE-2026-47080

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

EUVD-2026-63878

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

EEF-CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

Summary XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause fo...

CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

CVE-2026-47080

CVE-2026-47080 is an XML Injection vulnerability in the joshnuss xml_builder Elixir library (versions 0.0.7 through before 2.4.1 ). The root cause is in XmlBuilder.escape/1 within lib/xml_builder.ex: when handling {:cdata, data}, the data is placed verbatim between without splitting on embedded ...