PT-2025-10710

Description The LocalS3 project, which implements an S3-compatible storage interface, contains a critical XML External Entity XXE Injection vulnerability in its XML parsing functionality. When processing XML requests for multipart upload operations, the application accepts and processes XML...

CVE-2025-27136: Improper Restriction of XML External Entity Reference

LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML...

CVE-2025-0162

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

CVE-2025-0162 affects IBM Aspera Shares 1.9.9–1.10.0 PL7. The issue is an XML External Entity (XXE) injection in XML processing, enabling a remote authenticated attacker to disclose sensitive data or cause memory/resource exhaustion. Root cause: improper handling of external entities in XML. Docu...

CVE-2025-0162 IBM Aspera Shares XML external entity injection

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

IBM Aspera Share code-related vulnerabilities

IBM Aspera Shares is a Web application from International Business Machines IBM. An XML external entity injection vulnerability exists in IBM Aspera Shares versions 1.9.9 through 1.10.0 PL7, which arises from a web system or product that does not have the correct filters set to allow references t...

XML External Entity (XXE) Injection

Overview org.lucee:lucee is a Lucee Server is a dynamic, Java based JSR-223, tag and scripting language used for rapid web application development. Affected versions of this package are vulnerable to XML External Entity XXE Injection in its REST endpoint. An attacker can execute code by supplying...

CVE-2023-38693 RCE in Lucee REST endpoint

Lucee Server or simply Lucee is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173...

CVE-2025-24521 Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference

External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25...

Linux Distros Unpatched Vulnerability : CVE-2024-3572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper...

Keysight Ixia Vision code-related vulnerabilities

Keysight Ixia Vision is a family of network packet agents from Keysight, Inc. A code issue vulnerability exists in Keysight Ixia Vision Product Family version 6.3.1, which stems from an external XML entity injection could lead to arbitrary file downloads...

Lucee code issue vulnerabilities

Lucee is a high-performance open source CFML server written in Java by Lucee Open Source. A code issue vulnerability exists in Lucee versions 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173, which stems from an XML External Entity References attack and could lead to remote code execution...

Linux Distros Unpatched Vulnerability : CVE-2023-45139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an...

Linux Distros Unpatched Vulnerability : CVE-2022-48565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid X...

Linux Distros Unpatched Vulnerability : CVE-2021-39371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An XML external entity XXE injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the...

CVE-2025-24521: Improper Restriction of XML External Entity Reference

External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25...

Linux Distros Unpatched Vulnerability : CVE-2020-25649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity X...

Linux Distros Unpatched Vulnerability : CVE-2022-2414

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve t...