15308 matches found
CVE-2026-58234 Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)
SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...
CVE-2026-58234
SAP Process Integration (SOAP Adapter) is affected by a Denial of Service vulnerability where a privileged user can send specially crafted requests containing deeply nested entity definitions , temporarily increasing processor load and degrading system responsiveness under certain conditions. The...
CVE-2026-58234 Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)
SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...
EUVD-2026-72574
SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...
PT-2026-86953
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...
PT-2026-86962
Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...
CVE-2026-78627: Insertion of Sensitive Information into Log File
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...
CVE-2026-84282: Undefined Security Weakness
A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...
PT-2026-87103
A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...
CVE-2026-76958: Improper Restriction of XML External Entity Reference
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...
CVE-2026-58234: Improper Restriction of Recursive Entity References in DTDs
SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...
CVE-2026-76971: Server-Side Request Forgery (SSRF)
Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...
CVE-2026-78574: Untrusted Search Path
The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...
PT-2026-86949
SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...
CLSA-2026-1788820092 TuxCare security update for org.springframework.integration (5 CVEs)
TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.20-tuxcare.6...
Deserialization Of Untrusted Data
Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to SerializingHttpMessageConverter deserializing HTTP request bodies using ObjectInputStream.readObject without class filtering, which allows an unauthenticated attacker to provide a crafted serialized...
Server-Side Request Forgery (SSRF)
Spring Integration is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of UDP inbound adapter requests, which allows an unauthenticated attacker to send a crafted UDP packet and cause the server to send UDP datagrams to arbitrary internal or...
Deserialization Of Untrusted Data
Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the jsonTypeId header being used to determine the deserialization target class without a type or package allow-list, which allows an attacker to specify a malicious class and potentially achieve...
Arbitrary File Write
org.springframework.integration, spring-integration-zip is vulnerable to arbitrary file write. The vulnerability is due to improper validation of the filename header when processing messages with ZipResultType.FILE, which allows an attacker to specify an arbitrary filesystem path and cause the...