CVE-2024-13190

CVE-2024-13190 affects ZeroWdd myblog 1.0, specifically the file src/main/resources/mapper/BlogMapper.xml. The vulnerability arises from manipulation of the findBlogList and getTotalBlogs arguments, leading to XML Injection. It is a network-origin vulnerability with low privileges required, no us...

The vulnerability of the query_to_xml_and_xmlschema/table_to_xml/table_to_xml_and_xmlschema function in the Apache Superset data visualization software allows a hacker to execute arbitrary SQL code.

The vulnerability of the querytoxmlandxmlschema/tabletoxml/tabletoxmlandxmlschema function exists due to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

The vulnerability of the software platform for monitoring and managing IT infrastructure—Operations Bridge Manager (OBM)—is related to incorrect restrictions on XML links to external objects. This allows a malicious actor to gain unauthorized access to confidential information.

The vulnerability of the software platform for monitoring and managing IT infrastructure, Operations Bridge Manager OBM, is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized...

LangChain < 0.1.35 XXE

The version of LangChain installed on the remote host is prior to 0.1.35. It is, therefore, affected by a XML External Entity XXE vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers o...

PT-2025-2048 · Unknown · Zerowdd Myblog

Name of the Vulnerable Software and Affected Versions: ZeroWdd myblog version 1.0 Description: A critical issue has been found in the unknown code of the file src/main/resources/mapper/BlogMapper.xml. The manipulation of the findBlogList and getTotalBlogs arguments leads to xml injection. The...

CVE-2024-35532

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...

CVE-2024-46602

An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity XXE vulnerability may allow an attacker to cause a Denial of Service DoS via a crafted XML payload...

CVE-2024-46603

An XML External Entity XXE vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service DoS via a crafted XML payload...

CVE-2024-46602

An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity XXE vulnerability may allow an attacker to cause a Denial of Service DoS via a crafted XML payload...

CVE-2024-46603

An XML External Entity XXE vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service DoS via a crafted XML payload...

Server-Side Request Forgery (SSRF)

ch.qos.logback, logback-core is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of the DOCTYPE declaration in XML configuration files, allowing an attacker to forge requests...

Elspec G5 Digital Fault Recorder 代码问题漏洞

Elspec G5 Digital Fault Recorder is a digital fault recorder from Elspec, Israel. It is used to monitor and record fault events and waveform data in power systems. A security vulnerability exists in Elspec G5 Digital Fault Recorder version 1.2.1.12 and prior versions, which stems from the presenc...

CVE-2024-46602

Summary: CVE-2024-46602 affects Elspec G5 digital fault recorder, versions 1.2.1.12 and earlier. The issue is an XML External Entity (XXE) vulnerability that may enable a remote attacker to trigger a Denial of Service via a crafted XML payload. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N...

CVE-2024-46603

An XML External Entity XXE vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service DoS via a crafted XML payload...

CVE-2024-46603

An XML External Entity XXE vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service DoS via a crafted XML payload...

Intersec Geosafe-ea 缓冲区错误漏洞

Intersec Geosafe-ea is an application from Intersec France. A security vulnerability exists in Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14, which stems from the presence of an XML External Entity Injection vulnerability that could allow an attacker to perform an arbitrary file read...

PT-2025-2742 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.2.1.12 and earlier Description: An issue was discovered that may allow an attacker to cause a Denial of Service DoS via a crafted XML payload due to an XML External Entity XXE vulnerability...

CVE-2024-46603

Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 is affected by an XML External Entity (XXE) vulnerability that can cause a Denial of Service (DoS) when processing crafted XML payloads. The issue’s root cause is XXE in the XML parsing path. Exploitation details are not provided in ...

CVE-2024-35532

Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14 contain an XML External Entity (XXE) injection vulnerability. The flaw allows an attacker to read arbitrary files with the running process’s privileges, initiate SSRF requests, or cause a Denial of Service through unspecified vectors. The...

CVE-2024-35532

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...