USN-7901-1: CRaC JDK 21 vulnerabilities

Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. CVE-2025-53057 Darius Bohni discovered that the JA...

USN-7900-1 openjdk-17-crac vulnerabilities

Jinfeng Guo discovered that the Security component of CRaC JDK 17 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. CVE-2025-53057 Darius Bohni discovered that the JA...

USN-7900-1: CRaC JDK 17 vulnerabilities

Jinfeng Guo discovered that the Security component of CRaC JDK 17 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. CVE-2025-53057 Darius Bohni discovered that the JA...

CVE-2025-66372

Mustang before 2.16.3 allows exfiltrating files via XXE attacks...

Security Bulletin: Astronomer with IBM is vulnerable to sensitive data leaks or malicious requests due to the Apache tika package (CVE-2025-54988)

Summary Apache tika is used by Astronomer with IBM as part of data parsing functionality. Vulnerability Details CVEID:CVE-2025-54988 DESCRIPTION: Critical XXE in Apache Tika tika-parser-pdf-module in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML...

GHSA-24HM-WM2H-H8W7 Peppol-py is vulnerable to XXE attacks due to Saxon configuration

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host...

Peppol-py is vulnerable to XXE attacks due to Saxon configuration

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host...

XML External Entity (XXE) Injection

Overview peppol-py is an A python implementation for sending peppol eDelivery AS4 documents. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the XML validation process. An attacker can access sensitive files from the filesystem and exfiltrate their conten...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the XML parsing process. An attacker can access sensitive files by submitting specially crafted XML data containing external entities. Details XXE Injection is a type of attack against an applicatio...

PT-2025-48313

Name of the Vulnerable Software and Affected Versions Peppol-py versions prior to 1.1.1 Description Peppol-py before version 1.1.1 contains a flaw due to the Saxon configuration that allows for XML External Entity XXE attacks. When processing XML-based invoices, the XML parser is susceptible to...

CVE-2025-66370

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem...

CVE-2025-66372

Mustang before 2.16.3 allows exfiltrating files via XXE attacks...

CVE-2025-66372

Mustangproject

PT-2025-48314

Name of the Vulnerable Software and Affected Versions Mustang versions prior to 2.16.3 Description Mustang before version 2.16.3 is susceptible to XML External Entity XXE attacks, which can lead to the exfiltration of files. XXE attacks occur when an application parses XML input that contains a...

CVE-2025-66370

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem...

CVE-2025-66372

Mustang before 2.16.3 allows exfiltrating files via XXE attacks...

PT-2025-48312

Name of the Vulnerable Software and Affected Versions Kivitendo versions prior to 3.9.2 Description Kivitendo is susceptible to an XML External Entity XXE injection. An attacker can exploit this by uploading an electronic invoice in the ZUGFeRD format, potentially allowing them to read and...

CVE-2025-66372

Mustang before 2.16.3 allows exfiltrating files via XXE attacks...

CVE-2025-66371

CVE-2025-66371 affects Peppol-py prior to 1.1.1. The issue is an XXE vulnerability caused by Saxon configuration that allows the XML parser to read local files during XML-based invoice validation, potentially exposing content to a remote host. Multiple sources (RedHat, CIRCL, OSV, NVD, Snyk, CNNV...

kivitendo-erp 代码问题漏洞

kivitendo-erp is a kivitendo open source enterprise resource planning system. A code issue vulnerability exists in kivitendo-erp versions prior to 3.9.2, which stems from an XXE injection attack that may result when uploading electronic invoices in ZUGFeRD format...