18563 matches found
CVE-2025-34411
...
CVE-2025-34411
The Convercent Whistleblowing Platform exposes an unauthenticated API endpoint at /GetLegalEntity that returns internal customer legal-entity names based on a supplied searchText fragment. An unauthenticated attacker can query the endpoint with common legal-suffix terms to enumerate Convercent te...
EUVD-2025-203380
The Convercent Whistleblowing Platform operated by EQS Group exposes an unauthenticated API endpoint at /GetLegalEntity that returns internal customer legal-entity names based on a supplied searchText fragment. A remote unauthenticated attacker can query the endpoint using common legal-suffix ter...
Adobe ColdFusion XML External Entity References Improperly Restricted Vulnerability (CNVD-2026-0494441)
Adobe ColdFusion is a dynamic Web server platform and application development framework maintained by Adobe for rapidly building and deploying data-driven dynamic Web sites, Web applications, and enterprise-class services. Adobe ColdFusion suffers from an improperly restricted XML external entity...
Adobe ColdFusion XML External Entity References Improperly Restricted Vulnerability (CNVD-2026-0494343)
Adobe ColdFusion is a dynamic Web server platform and application development framework maintained by Adobe for rapidly building and deploying data-driven dynamic Web sites, Web applications, and enterprise-class services. Adobe ColdFusion suffers from an improperly restricted XML external entity...
PT-2025-51234
Name of the Vulnerable Software and Affected Versions Convercent Whistleblowing Platform affected versions not specified Description The platform exposes an unauthenticated API endpoint at /GetLegalEntity that returns internal customer legal-entity names based on a supplied searchText fragment. A...
Adobe ColdFusion XML External Entity References Improperly Restricted Vulnerability
Adobe ColdFusion is a dynamic Web server platform and application development framework maintained by Adobe for rapidly building and deploying data-driven dynamic Web sites, Web applications, and enterprise-class services. Adobe ColdFusion suffers from an improperly restricted XML external entity...
XML External Entity (XXE) Injection
peppolpy is vulnerable to XML External Entity XXE injection. The vulnerability is due to insecure Saxon XML parser configuration, where external entities are allowed during XML invoice validation, enabling attackers to read local files and exfiltrate their contents to a remote host...
XML External Entity (XXE) Injection
Mustang is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper restriction of external entity references during XML processing, which allows an attacker to exploit XXE attacks to exfiltrate arbitrary files from the affected system...
XML External Entity (XXE) Injection
Jenkins Semantic Versioning Plugin is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper validation of controller/agent messages and unrestricted parsing of attacker-controlled files containing external entities, allowing attackers controlling agent processes to...
XML External Entity (XXE)
org.jenkins-ci.plugins, jdepend is vulnerable to XML External Entity XXE. The vulnerability is due to improper configuration of the XML parser that does not disable external entity processing, which allows an attacker to exploit crafted XML input to access sensitive information or perform...
XML External Entity (XXE) Injection
org.wso2.am:am-distribution-parent are vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper configuration of the XML parser without sufficient restrictions, which allows an attacker to supply malicious XML to read sensitive files or trigger denial-of-service...
XML External Entity (XXE)
GeoServer is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML entity resolution in schema parsing, which allows an attacker to exploit external entity references to access sensitive data or perform unauthorized actions...
XML External Entity (XXE) Injection
Jenkins TestComplete support Plugin is vulnerable to XML External Entity XXE Injection. The vulnerability is due to the XML parser not being securely configured to disable external entity processing, allowing attackers to supply crafted XML that can access local files or trigger external network...
XML External Entity (XXE)
org.wso2.carbon.mediation, org.wso2.carbon.localentry is vulnerable to XML External Entity XXE. The vulnerability is due to improper XML parser configuration without sufficient restrictions on external entity resolution, which allows an unauthenticated remote attacker to read sensitive files or...
XML External Entity (XXE) Injection
Jenkins CCCC Plugin is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper configuration of the XML parser without XXE protection, which allows an attacker to process malicious XML input and access sensitive resources...
XML External Entity (XXE)
org.jenkins-ci.plugins, generic-webhook-trigger is vulnerable to XML External Entity XXE. The vulnerability is due to improper XML parser configuration that does not disable external entity processing, which allows an attacker to exploit crafted XML input to access sensitive information or perfor...
XML External Entity (XXE) Injection
cyclonedx-core-java is vulnerable to XML External Entity XXE injection. The vulnerability is due to an insecurely configured XML Validator, where external entity processing was not fully disabled during XML validation, allowing attackers to supply a crafted CycloneDX XML BOM that triggers externa...
