PHP 安全漏洞

PHP is a scripting language for PHP that is executed server-side. A security vulnerability exists in PHP versions prior to 8.1.33, 8.2.29, 8.3.23, and 8.4.10, which stems from a vulnerability that could result in a null pointer dereference when parsing XML data, affecting server availability...

SUSE CVE-2025-6491

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server...

PT-2025-29896 · Git +1 · Pidgin

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The software is susceptible to a heap-buffer-overflow write issue. The crash occurs within the xmlParseAttValueInternal function, triggered by a structural error during XML parsing,...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to the DocumentBuilderFactory used in the XunitXmlPlugin.java file, which is used without disabling DTDs or external entities.. An attacker can access arbitrary files on the file system or initiate...

CVE-2025-47293

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity XXE attack and to a server-side request forgery SSRF attack. This allows an attacker to elevate their...

CVE-2025-47293

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity XXE attack and to a server-side request forgery SSRF attack. This allows an attacker to elevate their...

CVE-2025-47293 PowSyBl Core XML Reader allows XXE and SSRF

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity XXE attack and to a server-side request forgery SSRF attack. This allows an attacker to elevate their...

CVE-2025-47293 PowSyBl Core XML Reader allows XXE and SSRF

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity XXE attack and to a server-side request forgery SSRF attack. This allows an attacker to elevate their...

PowSyBl Core 安全漏洞

PowSyBl Core is a PowSyBl open source software building framework for power systems. A security vulnerability exists in PowSyBl Core versions prior to 6.7.2 that stems from XML parsing vulnerability to XML external entity attacks and server-side request forgery attacks...

DEBIAN-CVE-2025-6170

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare...

CVE-2025-49794 Libxml: heap use after free (uaf) leads to denial of service (dos)

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's...

CVE-2025-49794 Libxml: heap use after free (uaf) leads to denial of service (dos)

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's...

Astra Linux – Vulnerability in Ruby 3.1

REXML is an XML toolkit for Ruby. The REXML gem before version 3.2.6 has a denial-of-service vulnerability when it parses an XML document with many tags in an attribute value. Users who need to parse untrusted XMLs may be affected by this vulnerability. The REXML gem version 3.2.7 or later includ...

libxml2 安全漏洞

libxml2 is a GNOME open source library for parsing XML documents. It is written in C and can be called by many languages, such as C, C++, and XSH. A security vulnerability exists in libxml2, which stems from a post-release reuse issue when parsing XPath elements, which could lead to a program cra...

TencentOS Server 3: ruby:3.3 (TSSA-2024:0775)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0775 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

OSV-2025-465 Heap-buffer-overflow in xmlParsePubidLiteral

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424613315 Crash type: Heap-buffer-overflow WRITE 1 Crash state: xmlParsePubidLiteral xmlParseExternalID xmlParseNotationDecl...

OSV-2025-457 Heap-buffer-overflow in xmlParsePubidLiteral

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424242614 Crash type: Heap-buffer-overflow WRITE 1 Crash state: xmlParsePubidLiteral xmlParseExternalID xmlParseEntityDecl...

PT-2025-26667 · Git +1 · Libxml2

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The software is susceptible to a heap-buffer-overflow write issue. The crash occurs during the execution of the xmlParsePubidLiteral, xmlParseExternalID, and xmlParseEntityDecl functions...

K000151742: REXML vulnerability CVE-2024-43398

Security Advisory Description REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be...

XML External Entity (XXE) Injection

PHPOffice/math is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper XML parsing using the LIBXMLDTDLOAD flag without filtering, allowing external entity resolution when loading XML data...