55517 matches found
Siemens SIMATIC S7-1500 Improper Restriction of XML External Entity Reference (CVE-2013-0340)
expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XMLSetEntityDeclHandler function, which allows remote attackers to cause a denial of service resource consumption, send HTTP requests to intranet servers, or read arbitrary files via a...
Siemens SIMATIC S7-1500 Out-of-bounds Read (CVE-2019-15903)
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read. This plugin only works with Tenable.ot. Please...
Siemens SIMATIC S7-1500 Use After Free (CVE-2022-43680)
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...
Siemens SIMATIC S7-1500 Improper Restriction of Recursive Entity References in DTDs (CVE-2023-52426)
libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...
Security Bulletin: IBM InfoSphere Information Server is potentially vulnerable to XML External Entity Injection (XXE)
Summary An XML External Entity Injection XXE vulnerability in InfoSphere Information Server Manager can potentially be used by an attacker to retrieve sensitive documents. Information Server Manager has a bulk import feature to help users import lists of Source Control Module SCM websites or user...
Security Bulletin: IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability (CVE-2025-12531)
Summary An XML external entity injection XXE vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-12531 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote...
CVE-2025-11700
N-central versions 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure...
CVE-2025-11700
N-able N-Central is affected by CVE-2025-11700. Versions earlier than 2025.4 are vulnerable to an XML External Entity (XXE) injection, enabling information disclosure. Remediation: upgrade to version 2025.4 or later.
CVE-2025-11700 N-central Multiple XXE Injection Vulnerabilities
N-central versions 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure...
CVE-2025-64518
An XML External Entity XXE injection vulnerability was found in the CycloneDX Java core library’s XML validation step where the XML Validator was not configured securely. When a specially crafted CycloneDX BOM XML is validated, external XML entities can be processed XXE, allowing an attacker to...
CVE-2025-12732 WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting function in all versions up to, and including, 7.33. This makes it possible for authenticated attacker...
CVE-2025-12732
CVE-2025-12732 impacts the WordPress plugin “WP Import – Ultimate CSV XML Importer for WordPress” (versions
Malicious code in subscription-xml-jasmine-apollo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eabecc43d01c8587b8f2f53eb45388a9476cf274b7a7c45c565f45dddd21bef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-124757
Malicious code in mongoose-nextjs-tailwindcss-xml npm...
EUVD-2025-116482
Malicious code in astro-xo-dotenv-parse-variables-xml npm...
EUVD-2025-115324
Malicious code in chromedriver-xml-pegasus-changelog npm...
EUVD-2025-113185
Malicious code in global-csrf-xml-package npm...
EUVD-2025-122551
Malicious code in rest-xml-oberon-eslint npm...