LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

Description The LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare...

CVE-2025-25940

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service due to jackson-databind package

Summary jackson-databind is used by the DataStage on Cloud Pak for Data ds-runtime service as part of JSON content handling. Vulnerability Details CVEID:CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secure...

libxml2: Use-After-Free in libxml2

A flaw was found in libxml2. This vulnerability allows a use-after-free via a crafted XML document validated against an XML schema with certain identity constraints or a crafted XML schema...

libxml2: Use-After-Free in libxml2

A flaw was found in libxml2. This vulnerability allows a use-after-free via a crafted XML document validated against an XML schema with certain identity constraints or a crafted XML schema...

PT-2025-10599 · Visicut · Visicut

Name of the Vulnerable Software and Affected Versions: VisiCut version 2.1 Description: The issue allows code execution via insecure XML deserialization in the loadPlfFile method of VisicutModel.java. Recommendations: For VisiCut version 2.1, consider restricting the use of the loadPlfFile method...

CVE-2025-25940

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java...

CVE-2025-25940

CVE-2025-25940 affects VisiCut 2.1. The vulnerability arises from insecure XML deserialization in the loadPlfFile method of VisicutModel.java, enabling potential code execution. The published metrics indicate a CRITICAL impact (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; base score 9.8). The c...

CVE-2025-25940

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java...

CVE-2025-25940

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java...

CVE-2025-0162

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162 IBM Aspera Shares XML external entity injection

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162 IBM Aspera Shares XML external entity injection

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

CVE-2025-0162 affects IBM Aspera Shares 1.9.9–1.10.0 PL7. The issue is an XML External Entity (XXE) injection in XML processing, enabling a remote authenticated attacker to disclose sensitive data or cause memory/resource exhaustion. Root cause: improper handling of external entities in XML. Docu...

CVE-2025-24521

External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25...

CVE-2023-38693

Lucee Server or simply Lucee is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173...

Cleo LexiCom Harmony 5.8.0.23 CSRF / Command Execution

Cleo LexiCom Harmony version 5.8.0.23 suffers from a remote command execution vulnerability that can be leveraged via a cross site request forgery attack. ============================================================================================================================================= ...

IBM Aspera Shares 代码问题漏洞

IBM Aspera Shares is a Web application from International Business Machines IBM. An XML external entity injection vulnerability exists in IBM Aspera Shares versions 1.9.9 through 1.10.0 PL7, which arises from a web system or product that does not have the correct filters set to allow references t...