CVE-2025-20184

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an affected device. The attacker must authenticate with valid...

Security Bulletin: XML External Entity Injection vulnerability affect IBM Business Automation Workflow - CVE-2024-28168

Summary IBM Business Automation Workflow is vulnerable to a XML External Entity Injection attack. Vulnerability Details CVEID:CVE-2024-28168 DESCRIPTION: Apache XML Graphics FOP is vulnerable to an XML External Entity Injection XXE attack when processing XML data. By sending specially crafted XML...

CVE-2025-1108

CVE-2025-1108 affects Janto, versions prior to r12. The issue is an insufficient data authenticity verification vulnerability that lets an unauthenticated attacker modify the content of password-reset emails by sending a crafted POST request that injects malicious content into the Xml parameter a...

CVE-2024-49352

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory...

CVE-2025-24646

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS.This issue affects XML for Avito: from n/a through = 2.5.2...

PT-2025-5973 · Janto · Janto

Name of the Vulnerable Software and Affected Versions: Janto versions prior to r12 Description: The issue concerns an insufficient data authenticity verification vulnerability. This vulnerability allows an unauthenticated attacker to modify the content of emails sent to reset the password. To...

Ubuntu: Security Advisory (USN-7256-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-54171

IBM EntireX 11.1 is vulnerable to an XML external entity injection XXE attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2024-54171

IBM EntireX 11.1 is vulnerable to an XML external entity injection XXE attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2024-54171 IBM EntireX XML external entity injection

IBM EntireX 11.1 is vulnerable to an XML external entity injection XXE attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2024-54171 IBM EntireX XML external entity injection

IBM EntireX 11.1 is vulnerable to an XML external entity injection XXE attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2024-54171

IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) when processing XML data. An authenticated attacker could exploit this to expose sensitive information or cause memory/resource consumption. Root cause: CWE-611 (Improper Restriction of XML External Entity Reference). Remedi...

firefox: thunderbird: Use-after-free in XSLT

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash...

firefox: thunderbird: Use-after-free in XSLT

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash...

Security Bulletin: Multiple security vulnerabilities were discovered in IBM Verify Identity Governance

Summary Multiple security vulnerabilities in IBM Java and IBM WebSphere Liberty have been addressed in the latest release of IBM Verify Identity Governance formerly known as IBM Security Verify Governance. Vulnerability Details CVEID:CVE-2024-27268 DESCRIPTION: IBM WebSphere Application Server...

CVE-2021-39181

OpenOlat is a web-based learning management system LMS. Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file e.g. a course any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the...

USN-7256-1: Ruby vulnerabilities

It was discovered that Ruby incorrectly handled parsing of an XML document that has specific XML characters in an attribute value using REXML gem. An attacker could use this issue to cause Ruby to crash, resulting in a denial of service...

CVE-2022-43941

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference...

CVE-2022-3980

An XML External Entity XEE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4...

Ubuntu 20.04 LTS : Ruby vulnerabilities (USN-7256-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7256-1 advisory. It was discovered that Ruby incorrectly handled parsing of an XML document that has specific XML characters in an attribute value using REXML gem. An...