The vulnerability in the web interface of the risk management platforms IBM OpenPages and IBM OpenPages with Watson allows attackers to carry out XXE attacks.

The vulnerability of the IBM OpenPages and IBM OpenPages with Watson web interfaces relates to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

PHPGurukul Hostel Management System 注入漏洞

Hostel Management System is a hostel management system. Hostel Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the Username parameter of the /includes/login-hm.inc.php file. An attacker can use this...

Malicious code in raydium-sdk-v6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15f2bf4f7d00a9a160e45525fc4b09ccf0957db423f83602f0e2aa72dde0ff2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

In libexpat version 2.6.1, an XML Entity Expansion attack is possible when external parsers are used in isolation created using XMLExternalEntityParserCreate...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: The code “openvswitch: switch to per-action label counting in conntrack” has been reverted. Currently, the ovsctsetlabels function is only called for confirmed conntrack entries within ovsctcommit. However, if the conntrack entry...

TencentOS Server 2: pki-core (TSSA-2022:0289)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0289 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Malicious code in browser-history-analytics (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e1ac674eaa856956dea531487502bd21a51f5324bdfcaf788645bbbb41eb27f5 When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...

MAL-2025-191695 Malicious code in browser-history-analytics (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e1ac674eaa856956dea531487502bd21a51f5324bdfcaf788645bbbb41eb27f5 When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...

Malicious code in browser-history-analysis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 032a326beadf36ce66d29555a7dacc90d6dfc733435dc61852cbc1e5128ee73d When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...

CVE-2025-36506

External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted request, arbitrary files in the file system can be overwritten with log data...

The vulnerability of the gt-xsd-core and gt-wfs-ng libraries of GeoTools allows attackers to perform XXE attacks.

The vulnerability of the gt-xsd-core and gt-wfs-ng libraries of GeoTools is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to perform XXE attacks remotely...

GHSA-MVP5-QX9C-C3FV

creationtimestamp| type| source ---|---|--- 2025-06-13 17:38:04+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18322 2025-06-13 18:01:53+00:00| published-proof-of-concept| Telegram/BdAJvjHyhFMVsKfZl02ptmuMNqjhviASPolesySVDo2DxO4...

Malicious code in mdp-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9dbfb2d3ae272dd0bda3bab2d03d7f1461dc50e5b834fd48ab7510f7e55b2a5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update for libxml2

This update for libxml2 fixes the following issues: CVE-2024-40896: Fixed XXE vulnerability bsc1234812 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your...

RICOH Streamline NX V3 PC Client 安全漏洞

RICOH Streamline NX V3 PC Client is a complete solution for large-scale, integrated management of devices from Ricoh RICOH Japan. A security vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 through 3.242.0, which originates from a file name or path external control, and cou...

The vulnerability of the software client service for Cisco WebEx Meetings allows a perpetrator to compromise the integrity of the protected information.

The vulnerability of Cisco Webex Meetings software client services relates to the loading of unreliable external data alongside reliable data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information...

Malicious code in @jito-lab/provider (npm)

The package communicates with a domain associated with malicious activity...

CVE-2024-34711

GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. By default, GeoServer use...

CVE-2025-49190

The application is vulnerable to Server-Side Request Forgery SSRF. An endpoint can be used to send server internal requests to other ports...

CVE-2025-44044

Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity XXE. An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system...