CVE-2024-12801 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks

Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in XML...

XML External Entity (XXE)

Unstructured is vulnerable to XML External Entity XXE. The vulnerability is due to improper configuration while setting resolveentities=False for parsing XML with lxml in partitionxml, which allows external entities to be processed...

REXML denial of service vulnerability

...

RLSA-2024:10952 Moderate: php:7.4 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: 1-byte array overrun in common path resolve code CVE-2023-0568 php: Passwordverify always return true with some hash CVE-2023-0567 php: Missing error check and insufficient random bytes in...

SUSE CVE-2024-46455

unstructured v.0.14.2 and before is vulnerable to XML External Entity XXE via the XMLParser...

CVE-2024-55081

An XML External Entity XXE injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input...

The vulnerability of the Ucum library in the Java programming language, which allows attackers to perform XXE attacks

The vulnerability of the Ucum library for the Java programming language is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

CVE-2024-55081

CVE-2024-55081 describes an XML External Entity (XXE) injection in the Chat2DB 0.3.5 component /datagrip/upload that can lead to arbitrary code execution when a crafted XML input is supplied. Affected software: Chat2DB v0.3.5; vulnerable part: /datagrip/upload; root cause: XXE vulnerability. Impa...

QOS.CH logback-core Server-Side Request Forgery vulnerability

Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in XML configuration files...

PT-2024-36471 · Chat2Db · Chat2Db

Name of the Vulnerable Software and Affected Versions: Chat2DB version 0.3.5 Description: A vulnerability in the /datagrip/upload component of Chat2DB allows attackers to execute arbitrary code via supplying a crafted XML input, exploiting an XML External Entity XXE injection flaw. Recommendation...

CVE-2024-55081

An XML External Entity XXE injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input...

logback 安全漏洞

logback is a reliable, general-purpose, fast and flexible Java logging framework open-sourced by QOS.CH. A security vulnerability exists in logback version 1.5.12, which stems from SaxEventRecorder containing a server-side request forgery issue. An attacker can exploit this vulnerability to forge...

OpenText Operations Bridge Manager 安全漏洞

OpenText Operations Bridge Manager is an enterprise activity and performance management software from OpenText Canada. A security vulnerability exists in OpenText Operations Bridge Manager that stems from an improper restriction of the XML External Entity References vulnerability, which allows...

Important: expat

Issue Overview: An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer. CVE-2024-45490 Affected Packages: expat Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2...

CLSA-2024-1734535703 php: Fix of CVE-2023-3823

CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing...

XML External Entity

org.http4k, http4k-format-xml is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper handling of malicious XML content in requests, which could allow attackers to access sensitive local information, perform Server-side Request Forgery SSRF, or potentially execute...

PT-2024-36616 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to v1.18.27 Description: DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the JDBC connection string, the paramete...

PT-2024-9971 · Opentext · Opentext Operations Bridge Manager

Name of the Vulnerable Software and Affected Versions: OpenText Operations Bridge Manager versions 2017.05 through 2020.10 Description: The issue is related to an Improper Restriction of XML External Entity Reference, which could allow for Input Data Manipulation. This could be exploited to gain...

RHEL 9 : expat (RHSA-2024:11200)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11200 advisory. Expat is a C library for parsing XML documents. Security Fixes: libexpat: expat: DoS via XMLResumeParser CVE-2024-50602 For more details about the...

Moderate: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...