CVE-2025-13209

CVE-2025-13209 affects bestfeng oa_git_free up to version 9.5. The vulnerability lies in the updateWriteBack function (file yimioa-oa9.5/server/c-flow/src/main/java/com/cloudweb/oa/controller/WorkflowPredefineController.java), where manipulation of the writeProp argument can trigger an XML Extern...

Libvirt: denial of service in xml parsing

...

PT-2025-47061

Name of the Vulnerable Software and Affected Versions bestfeng oa git free versions up to 9.5 Description A flaw exists in bestfeng oa git free up to version 9.5. The issue is related to the manipulation of the writeProp argument within the updateWriteBack function located in the file...

oa_git_free 代码问题漏洞

bestfeng oagitfree line cloud process engine is an enterprise automation process platform from China Cloud OA bestfeng company. A code issue vulnerability exists in oagitfree 9.5 and earlier versions, which originates from the parameter in the file...

CVE-2025-13187 Intelbras ICIP acessodeusuario.xml credentials storage

A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipulation of the argument NomeUsuario/SenhaAcess leads to unprotected storage of credentials. The attack may be launched remotely. The exploit...

EUVD-2025-197673

A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipulation of the argument NomeUsuario/SenhaAcess leads to unprotected storage of credentials. The attack may be launched remotely. The exploit...

CVE-2025-13187 Intelbras ICIP acessodeusuario.xml credentials storage

A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipulation of the argument NomeUsuario/SenhaAcess leads to unprotected storage of credentials. The attack may be launched remotely. The exploit...

HSEC-2023-0004 xml-conduit unbounded entity expansion

xml-conduit unbounded entity expansion A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. ...

OESA-2025-2664 lasso security update

The package is a implements the Liberty Alliance Single Sign On standards library, includeing the SAML2 and SAML specifications. it provides bindings for multiple languages.and allows to handle the whole life-cycle of SAML based Federations. Security Fixes: A denial of service vulnerability exist...

OESA-2025-2655 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability wh...

Security Bulletin: Security vulnerability has been found in IBM Application Gateway

Summary Security vulnerability has been addressed in IBM Application Gateway. Vulnerability Details CVEID:CVE-2023-52425 DESCRIPTION: libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for which multiple...

Intelbras ICIP 安全漏洞

Intelbras ICIP is an interface extension board from Intelbras, Brazil. A security vulnerability exists in Intelbras ICIP version 2.0.20, which stems from incorrect manipulation of the parameter NomeUsuario/SenhaAcess in the file /xml/sistema/acessodeusuario.xml, which could lead to improper stora...

SUSE SLES15 Security Update : lasso (SUSE-SU-2025:4090-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4090-1 advisory. - CVE-2025-46784: Fixed memory exhaustion in Entr'ouvert Lasso bsc1253094 - CVE-2025-46404: Fixed denial of service in Entr'ouvert...

Unity Linux 20.1070e Security Update: libxslt (UTSA-2025-990908)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990908 advisory. Uncontrolled recursion inXPath evaluationin libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPa...

PT-2025-48704

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.26 Django versions 5.1 through 5.1.14 Django versions 5.2 through 5.2.8 Description An issue exists in the way Django handles XML input. Specifically, algorithmic complexity within the django.core.serializers.xm...

Security update for lasso

This update for lasso fixes the following issues: CVE-2025-46784: Fixed memory exhaustion in Entr'ouvert Lasso bsc1253094 CVE-2025-46404: Fixed denial of service in Entr'ouvert Lasso bsc1253092 CVE-2025-46705: Fixed denial of service in Entr'ouvert Lasso bsc1253093 CVE-2025-47151: Fixed type...

CVE-2025-11700

N-central versions 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure...

SUSE-SU-2025:4090-1 Security update for lasso

This update for lasso fixes the following issues: - CVE-2025-46784: Fixed memory exhaustion in Entr'ouvert Lasso bsc1253094 - CVE-2025-46404: Fixed denial of service in Entr'ouvert Lasso bsc1253092 - CVE-2025-46705: Fixed denial of service in Entr'ouvert Lasso bsc1253093 - CVE-2025-47151: Fixed...

EUVD-2025-179910

Malicious code in cache-xml-stub-fire-nu npm...

Malicious code in xml-sails-cluster-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e47d11e94efa1d8dcc50c9b7719f33a12c4ac87761659e74645fc502db56b0e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...