GHSA-44C3-38H8-9FH9 Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build

Blind XXE vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to the use of an unsecured document to load privileges. An attacker can execute arbitrary code or cause a denial of service by submitting specially crafted XML data. Details XXE Injection is a type ...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to the use of an unsecured document to load privileges. An attacker can execute arbitrary code or cause a denial of service by submitting specially crafted XML data. Details XXE Injection is a type ...

DEBIAN-CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

Exploit for CVE-2025-49493

Akamai CloudTest XXE Exploit CVE-2025-49493 Overview Th...

CVE-2025-53689: Improper Restriction of XML External Entity Reference

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

Akamai CloudTest XML Injection

This is a Python-based exploit for CVE-2025-49493, which affects Akamai CloudTest versions before 60 2025.06.02 12988. The vulnerability allows for XML External Entity XXE injection through the SOAP service endpoint...

Apache Jackrabbit 安全漏洞

Apache Jackrabbit is a content repository from Apache Corporation USA. A security vulnerability exists in Apache Jackrabbit versions prior to 2.23.2, which stems from a blind XXE vulnerability in jackrabbit-spi-commons and jackrabbit-core...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-7523

A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-7523

CVE-2025-7523 affects Jinher OA 1.0. The vulnerability is an XML External Entity (XXE) reference issue in the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx that can be triggered remotely. Multiple sources confirm the flaw and public disclosure of the exploit. No concrete fix/version is provide...

CVE-2025-7523 Jinher OA DelTemp.aspx xml external entity reference

A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-7523 Jinher OA DelTemp.aspx xml external entity reference

A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

The vulnerability of the ColdFusion software platform lies in the improper limitation on XML references to external objects, which allows attackers to circumvent security restrictions.

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

Jinher OA 代码问题漏洞

Jinher OA is a collaborative management software from Jinher, China. A code issue vulnerability exists in Jinher OA version 1.0, which originates from an incorrect operation of file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx resulting in an XML external entity reference...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-6438

Schneider Electric EcoStruxure IT Data Center Expert (prior to 9.0; affected versions 8.3 and earlier) is affected by CVE-2025-6438: XML External Entity (XXE) injection via the DataExchange SOAP route, enabling unauthenticated or low-privilege exploitation to read local files and potentially caus...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

Malicious code in grallama (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9a320b2690b732632ebf0fc3d95fb5e7b73a3da0fa8a36714880645805464c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...