CVE-2025-23195 Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie

An XML External Entity XXE vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the DocumentBuilderFactory class without disabling external entity resolution. An attacker can...

Apache Ambari 代码问题漏洞

Apache Ambari is a software application from the Apache USA Foundation. Provides software developed to configure, manage and monitor Apache Hadoop clusters to simplify Hadoop management. A code issue vulnerability exists in Apache Ambari versions prior to 2.7.9, which stems from a vulnerability...

The vulnerability of the administrator’s user interface function “Configuration XML” of the Continuous Integration and Delivery (CI/CD) GoCD system allows a perpetrator to increase their privileges.

The vulnerability of the “Configuration XML” user interface function in the Continuous Integration and Delivery CI/CD GoCD system is related to improper authentication. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...

The vulnerability of the server for the Continuous Integration and Delivery system (CI/CD) of GoCD arises from incorrect restrictions on XML references to external objects. This allows attackers to perform XXE attacks.

The vulnerability of the CI/CD server of GoCD is related to an incorrect restriction on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

Debian dla-4018 : libruby2.7 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4018 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4018-2 [email protected] https://www.debian.org/lts/security/...

The vulnerability of the server for the Continuous Integration and Delivery system (CI/CD) of GoCD arises from incorrect restrictions on XML references to external objects. This allows attackers to perform XXE attacks.

The vulnerability of the CI/CD server of GoCD is related to an incorrect restriction on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

The vulnerability of the Kotlin HTTP http4k application library’s functionality is related to incorrect restrictions on XML links to external objects, allowing attackers to perform XXE attacks.

The vulnerability of the Kotlin HTTP http4k application’s toolset is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a remote attacker to perform XXE attacks...

CVE-2024-47113

IBM ICP - Voice Gateway 1.0.2, 1.0.2.4, 1.0.3, 1.0.4, 1.0.5, 1.0.6. 1.0.7, 1.0.7.1, and 1.0.8 could allow remote attacker to send specially crafted XML statements, which would allow them to attacker to view or modify information in the XML document...

CVE-2024-47113 IBM ICP - Voice Gateway XML injection

IBM ICP - Voice Gateway 1.0.2, 1.0.2.4, 1.0.3, 1.0.4, 1.0.5, 1.0.6. 1.0.7, 1.0.7.1, and 1.0.8 could allow remote attacker to send specially crafted XML statements, which would allow them to attacker to view or modify information in the XML document...

CVE-2024-47113 IBM ICP - Voice Gateway XML injection

IBM ICP - Voice Gateway 1.0.2, 1.0.2.4, 1.0.3, 1.0.4, 1.0.5, 1.0.6. 1.0.7, 1.0.7.1, and 1.0.8 could allow remote attacker to send specially crafted XML statements, which would allow them to attacker to view or modify information in the XML document...

CVE-2024-47113

CVE-2024-47113 affects IBM ICP - Voice Gateway versions 1.0.2–1.0.8. The issue is an XML injection/XML handling flaw that allows a remote attacker to send specially crafted XML statements and view or modify information within the XML document. IBM’s bulletin and Red Hat/IBM advisories indicate th...

[SECURITY] [DLA 4018-1] ruby2.7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4018-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès January 17, 2025 https://wiki.debian.org/LTS -...

CVE-2024-12476

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and potential remote code execution on the compromised computer, when specific crafted XML file is imported in the Web Designer configuration...

CVE-2024-12476

CVE-2024-12476 affects Schneider Electric Web Designer configuration tool. The defect is an XML External Entity (XXE) reference vulnerability (CWE-611) in the XML import path, leading to information disclosure, potential workstation integrity impact, and possible remote code execution on the comp...

CVE-2024-12476

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and potential remote code execution on the compromised computer, when specific crafted XML file is imported in the Web Designer configuration...

CVE-2024-12476

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and potential remote code execution on the compromised computer, when specific crafted XML file is imported in the Web Designer configuration...

CVE-2024-51462

IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data...

CVE-2024-51462

IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data...

CVE-2024-51462

IBM QRadar WinCollect Agent (Windows) versions 10.0.0–10.1.12 are affected by CVE-2024-51462 due to improper input validation of assumed immutable data, enabling a remote attacker to inject XML data into parameter values and potentially modify data. Remediation is to upgrade to WinCollect Standal...

CVE-2024-51462 IBM QRadar WinCollect Agent data manipulation

IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data...