CVE-2024-5535

CVE-2024-5535 PoC - OpenSSL NPN Buffer Overread Note : Nous n'avons pas découvert cela, nous avons seulement réalisé un PoC basé sur la publication. https://nvd.nist.gov/vuln/detail/cve-2024-5535...

CVE-2022-30190-Follina-Lab

🔴 CVE-2022-30190 — Follina MSDT RCE Lab Chercheur : Abhimanyu Rawat Rôle : Stage en Recherche Technique et Opérations de Cybersécurité Date : 8 mai 2026 📌 Qu'est-ce que Follina ? CVE-2022-30190 surnommée « Follina » est une vulnérabilité zero-day d’exécution de code à distance RCE dans Microsoft...

ktor-cve-2023-45612-poc

Ktor XXE Vulnerability Proof-of-Concept CVE-2023-45612 Résumé Impact : Accès arbitraire aux fichiers via une DTD XML malveillante avec une référence XXE. Cause racine : Analyseur XML non sécurisé. Ce dépôt contient une application Ktor 2.3.4 vulnérable configurée pour autoriser les entités extern...

CVE-2023-36845

CVE-2023-36845 Exploit de modification de variable externe PHP de Juniper JunOS J-Web CVE-2023-36845...

CVE-2025-58360

CVE-2025-58360 La vulnérabilité en question est CVE-2025-58360 score CVSS : 8,2, une faille de type XML External Entity XXE non authentifiée qui affecte toutes les versions antérieures à 2.25.5 inclus, et les versions 2.26.0 à 2.26.1. Elle a été corrigée dans les versions 2.25.6, 2.26.2, 2.27.0,...

CVE-2023-45612-PoC

CVE-2023-45612 https://nvd.nist.gov/vuln/detail/CVE-2023-45612 Description de la CVE Dans JetBrains Ktor avant la version 2.3.5, la configuration par défaut de ContentNegotiation avec le format XML était vulnérable à une attaque XXE. La vulnérabilité a été corrigée par @marychatte le 29 septembre...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' WMS-эндпоинт GeoServer уязвим к XXE-атаке 🌟 🏷️ Основная информация CVE ID : CVE-2025-58360 Опубликовано : 📅 25 ноября 2025 Последнее изменение : 📅 25 ноября 2025 всё ещё актуально на 26 ноября Тип уязвимости : XML External Entity XXE – CWE-611 Затронутое ПО : GeoServer...

CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

EUVD-2026-90762

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789

The camel-quarkus-support-xalan extension in Apache Camel Quarkus (versions 3.2.0 to 3.33.3 and 3.34.0 to 3.40.0) is vulnerable to CWE-611 due to a forced Xalan TransformerFactory that fails to honor JAXP external access restrictions. An attacker providing an XML document transformed via the xslt...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS-STREAM8:CLSA-2026:1776861173)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1776861173 advisory. - An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in X...

Rocky Linux 9.6 [TuxCare] Security Update: assertj-core / assertj-core-javadoc (ALMALINUX9.6:CLSA-2026:1788370561)

"The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788370561 advisory. - AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine JVM. Starting in version 1.4.0 and prior to version...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc Multiple Vulnerabilities (crlsa-2022_6057)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226057 advisory. dotnet: External Entity Injection during XML signature verification CVE-2022-34716 Tenable has extracted the preceding description block directly from the...

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1779579653)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779579653 advisory. - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorre...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc (crlsa-2022_6058)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226058 advisory. dotnet: External Entity Injection during XML signature verification CVE-2022-34716 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2023_5926)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235926 advisory. php: XML loading external entity without being enabled CVE-2023-3823 php: phar Buffer mismanagement CVE-2023-3824 php: 1-byte array overrun in common path...

Rocky Linux 10.2 [CIQ] Security Update: assertj-core / assertj-core-javadoc (crlsa-2026_59372)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202659372 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description block...

CVE-2026-102127

The Kiteworks Email Protection Gateway is vulnerable to an XML External Entity (XXE) injection due to an XML parser that does not restrict external entity references. If an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could submit a crafted mess...