CVE-2012-1102

It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used...

CVE-2025-4641 XML External Entity (XXE) injection vulnerability in WebDriverManager

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux XML parsing components modules allows Data Serialization External Entities Blowup. This vulnerability is associated with program files...

Peergos 代码问题漏洞

Peergos is a Peergos open source application. A security vulnerability exists in Peergos 1.1.0 and earlier versions that stems from improperly restricted XML external entity references in the WebDav servlet...

libxml2: XXE vulnerability

A flaw was found in libxml2. In the affected versions of libxml2, the SAX parser can generate events for external entities, even if custom SAX handlers try to override entity content by setting it to "checked." This vulnerability allows classic XML External Entity XXE attacks...

SUSE CVE-2025-37821

In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se-slice being set to U64MAX and resulting crash There is a code path in dequeueentities that can set the slice of a schedentity to U64MAX, which sometimes results in a crash. The offending case is when...

DEBIAN-CVE-2025-37821

In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se-slice being set to U64MAX and resulting crash There is a code path in dequeueentities that can set the slice of a schedentity to U64MAX, which sometimes results in a crash. The offending case is when...

UBUNTU-CVE-2025-37821

In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se-slice being set to U64MAX and resulting crash There is a code path in dequeueentities that can set the slice of a schedentity to U64MAX, which sometimes results in a crash. The offending case is when...

CVE-2025-37821 sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash

In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se-slice being set to U64MAX and resulting crash There is a code path in dequeueentities that can set the slice of a schedentity to U64MAX, which sometimes results in a crash. The offending case is when...

CVE-2025-37821

The CVE-2025-37821 issue in the Linux kernel’s scheduler (eevdf) caused se->slice to be set to U64_MAX during a complex dequeue sequence, leading to a large, destabilizing vruntime/vlag mismatch and a potential crash. The root cause was that, when dequeuing a delayed group entity whose parent ...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to insufficient validation of XML input in crafted URL paths. An attacker can read files from the server's filesystem or perform denial-of-service attacks by supplying malicious XML content. Note:...

libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash...

From TV5Monde to Govt: France Blames Russia’s APT28 for Cyberattacks

France accuses Russia's APT28 hacking group Fancy Bear of targeting French government entities in a cyber espionage campaign.…...

SUSE CVE-2025-22028

In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .sstream for stopped entities Syzbot reported 1 a warning prompted by a check in callsstream that checks whether .sstream operation is warranted for unstarted or stopped subdevs. Add a simple fix in...

CVE-2025-22028

In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .sstream for stopped entities Syzbot reported 1 a warning prompted by a check in callsstream that checks whether .sstream operation is warranted for unstarted or stopped subdevs. Add a simple fix in...

CVE-2025-22028

CVE-2025-22028 affects the Linux kernel media/v4l2 subsystem, specifically the vimc video capture path. The issue arises in vimc_streamer_pipeline_terminate() where .s_stream() could be invoked for subdevs that were not started or are stopped. The root cause is an unnecessary .s_stream() operatio...

CVE-2025-22028 media: vimc: skip .s_stream() for stopped entities

In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .sstream for stopped entities Syzbot reported 1 a warning prompted by a check in callsstream that checks whether .sstream operation is warranted for unstarted or stopped subdevs. Add a simple fix in...

Hitachi Vantara Pentaho Business Analytics Server 安全漏洞

Hitachi Vantara Pentaho Business Analytics Server is a modern data blending, integration and business analytics platform from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.2, which stems from an...

libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash...

Pakistan-Linked Hackers Expand Targets in India with CurlBack RAT and Spark RAT

A threat actor with ties to Pakistan has been observed targeting various sectors in India with various remote access trojans like Xeno RAT, Spark RAT, and a previously undocumented malware family called CurlBack RAT. The activity, detected by SEQRITE in December 2024, targeted Indian entities und...

The vulnerability of XML parser components in the iText software development tool allows attackers to execute XXE attacks.

The vulnerability of XML parser components in the iText software development tool is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks by sending specially created malicious PDF files...