Monthly
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 lets remote, unauthenticated attackers who can reach an XML-accepting endpoint read files or internal resources from the gateway host and, via entity expansion, exhaust memory. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) confirms no credentials or user interaction are required, with high confidentiality impact and low availability impact. There is no public exploit code and no indication of active exploitation, and IBM has published a patch through its support portal.
Authenticated users of the Arista Spectralight WiFi-server application can submit crafted XML requests that trigger external-entity resolution and disclose arbitrary local files from the server, with a secondary partial denial-of-service effect from entity processing. Exploitation requires valid credentials (CVSS 4.0 vector shows PR:L; the independent assessment concurs with PR:L) and network reach to an XML-accepting endpoint, so the realistic threat population is insiders or attackers who have already obtained an account rather than unauthenticated internet scanners. No public exploit code and no CISA KEV listing were identified at time of analysis, and the issue is rated CVSS 7.1 / CWE-611 - a moderate-severity, authentication-gated information-disclosure flaw rather than a top-tier emergency.
Improper restriction of XInclude resource resolution in Copernik XML Factory through 0.1.1 allows an attacker-controlled XML document to resolve xi:include hrefs when the stock JDK provider is in use, resulting in local file disclosure and server-side request forgery against internal HTTP endpoints. Only applications that obtain a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory() (or harden an externally supplied XMLReader via XmlFactories.harden()), run without Apache Xerces (xercesImpl) on the classpath, explicitly enable XInclude with setXIncludeAware(true) or the equivalent reader feature, and parse XML from an untrusted source are affected; the Xerces provider and the Android provider are not affected. No CVSS vector, EPSS score, or CISA KEV entry was provided, so no public exploit or active exploitation was identified at time of analysis, although the defect is confirmed and fixed by upstream commits and the 0.1.2 release.
Improper restriction of XML external entity resolution in the XSLT support extension of Apache Camel Quarkus (camel-quarkus-support-xalan) allows an attacker who supplies the XML document being transformed to read local files and to issue requests to internal network locations, because the bundled Xalan-J 2.7.x TransformerFactory predates JAXP 1.5 and cannot honour javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) rates this as network-reachable and unauthenticated with scope change and high confidentiality impact, though exploitation is conditional: the application must pull camel-quarkus-xslt, camel-quarkus-xslt-saxon, camel-quarkus-tika or camel-quarkus-xmlsecurity onto the classpath, and on the xslt component path the attacker-controlled body must reach the transformer already as a javax.xml.transform.Source rather than a String, byte[], InputStream, DOMSource or StAXSource. Affected releases are 3.2.0 before 3.33.3 and 3.34.0 before 3.40.0; patches exist in 3.33.3 and 3.40.0, and no public exploit has been identified at time of analysis.
Unauthenticated XML External Entity (XXE) processing in Kiteworks Email Protection Gateway allows a remote sender to read files accessible to the gateway service account - including cryptographic key material and credentials - and have them sent to a destination the sender controls. The vulnerable parsing path is only reachable when the optional, non-default message-processing feature is enabled, which is the sole reason the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L carries AC:H despite needing no authentication or user interaction; default installations are not exposed. Per the provided intelligence, no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and impact is bounded to files readable by the gateway service account plus the limited integrity/availability side effects typical of XXE.
XML external entity (XXE) injection in Apache Roller 6.1.5 lets an authenticated user who holds entry-editing rights on any weblog force the server to fetch and parse an attacker-influenced trackback response with an XML parser that resolves external entities, disclosing files readable by the Roller process account. The Trackback control is hidden in the standard UI, but its Struts2 action remains directly reachable over HTTP and no non-default server configuration is required, so the practical prerequisite is a valid low-privileged account plus a host the attacker controls to serve the malicious trackback XML (CVSS 3.1 7.7 High, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, scope change reflecting reads outside the application's own data). No public exploit code was identified at the time of analysis, and the vendor-released fix is Apache Roller 6.1.6, which eliminates the outbound trackback response parser.
XML external entity (XXE) processing in Apache Roller 6.1.5 allows an authenticated weblog administrator to read files accessible to the Roller process and to reach internal network addresses by importing a crafted OPML bookmark document, because the bookmark-import parser does not disable external entity resolution. The advisory confirms no non-default configuration is required - the administrator bookmark-import action is vulnerable out of the box on the affected release - which is consistent with the assessed CVSS 3.1 score of 7.7 High (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, scope changed, confidentiality-only impact). No public exploit code and no confirmed active exploitation have been identified at time of analysis; the issue is remediated in Apache Roller 6.1.6, which uses a hardened parser that disables external entities and document type declarations.
XML External Entity (XXE) injection in http4s-scala-xml's EntityDecoder for scala.xml.Elem (all versions before 0.24.1 and 1.0.0-M39) allows unauthenticated remote attackers who can supply XML message bodies to disclose files readable by the service process, perform server-side request forgery (SSRF) against internal network resources, or trigger denial of service via entity expansion. The decoders obtain a javax.xml.parsers.SAXParserFactory through SAXParserFactory.newInstance without configuring secure-processing features, so JDK default behavior resolves DOCTYPE declarations, external general and parameter entities, and external DTDs. Vendor-released fixes are 0.24.1 and 1.0.0-M39; no public exploit code has been identified at time of analysis, and reachability depends on an application actually using these decoders against untrusted XML.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read files and reach resources outside the application's security scope by submitting crafted XML to an XML-processing function (CWE-611 XML external entity injection). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N rates this 7.7 High: confidentiality impact is high with a scope change, but there is no integrity or availability effect, meaning the outcome is data exposure rather than code execution or service disruption. Exploitation requires a valid low-privilege DataStage account and network reachability to the affected XML handling surface; no user interaction is needed, and no public exploit identified at time of analysis. Patch available per vendor advisory (IBM support page node/7288649).
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 lets remote, unauthenticated attackers who can reach an XML-accepting endpoint read files or internal resources from the gateway host and, via entity expansion, exhaust memory. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) confirms no credentials or user interaction are required, with high confidentiality impact and low availability impact. There is no public exploit code and no indication of active exploitation, and IBM has published a patch through its support portal.
Authenticated users of the Arista Spectralight WiFi-server application can submit crafted XML requests that trigger external-entity resolution and disclose arbitrary local files from the server, with a secondary partial denial-of-service effect from entity processing. Exploitation requires valid credentials (CVSS 4.0 vector shows PR:L; the independent assessment concurs with PR:L) and network reach to an XML-accepting endpoint, so the realistic threat population is insiders or attackers who have already obtained an account rather than unauthenticated internet scanners. No public exploit code and no CISA KEV listing were identified at time of analysis, and the issue is rated CVSS 7.1 / CWE-611 - a moderate-severity, authentication-gated information-disclosure flaw rather than a top-tier emergency.
Improper restriction of XInclude resource resolution in Copernik XML Factory through 0.1.1 allows an attacker-controlled XML document to resolve xi:include hrefs when the stock JDK provider is in use, resulting in local file disclosure and server-side request forgery against internal HTTP endpoints. Only applications that obtain a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory() (or harden an externally supplied XMLReader via XmlFactories.harden()), run without Apache Xerces (xercesImpl) on the classpath, explicitly enable XInclude with setXIncludeAware(true) or the equivalent reader feature, and parse XML from an untrusted source are affected; the Xerces provider and the Android provider are not affected. No CVSS vector, EPSS score, or CISA KEV entry was provided, so no public exploit or active exploitation was identified at time of analysis, although the defect is confirmed and fixed by upstream commits and the 0.1.2 release.
Improper restriction of XML external entity resolution in the XSLT support extension of Apache Camel Quarkus (camel-quarkus-support-xalan) allows an attacker who supplies the XML document being transformed to read local files and to issue requests to internal network locations, because the bundled Xalan-J 2.7.x TransformerFactory predates JAXP 1.5 and cannot honour javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) rates this as network-reachable and unauthenticated with scope change and high confidentiality impact, though exploitation is conditional: the application must pull camel-quarkus-xslt, camel-quarkus-xslt-saxon, camel-quarkus-tika or camel-quarkus-xmlsecurity onto the classpath, and on the xslt component path the attacker-controlled body must reach the transformer already as a javax.xml.transform.Source rather than a String, byte[], InputStream, DOMSource or StAXSource. Affected releases are 3.2.0 before 3.33.3 and 3.34.0 before 3.40.0; patches exist in 3.33.3 and 3.40.0, and no public exploit has been identified at time of analysis.
Unauthenticated XML External Entity (XXE) processing in Kiteworks Email Protection Gateway allows a remote sender to read files accessible to the gateway service account - including cryptographic key material and credentials - and have them sent to a destination the sender controls. The vulnerable parsing path is only reachable when the optional, non-default message-processing feature is enabled, which is the sole reason the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L carries AC:H despite needing no authentication or user interaction; default installations are not exposed. Per the provided intelligence, no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and impact is bounded to files readable by the gateway service account plus the limited integrity/availability side effects typical of XXE.
XML external entity (XXE) injection in Apache Roller 6.1.5 lets an authenticated user who holds entry-editing rights on any weblog force the server to fetch and parse an attacker-influenced trackback response with an XML parser that resolves external entities, disclosing files readable by the Roller process account. The Trackback control is hidden in the standard UI, but its Struts2 action remains directly reachable over HTTP and no non-default server configuration is required, so the practical prerequisite is a valid low-privileged account plus a host the attacker controls to serve the malicious trackback XML (CVSS 3.1 7.7 High, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, scope change reflecting reads outside the application's own data). No public exploit code was identified at the time of analysis, and the vendor-released fix is Apache Roller 6.1.6, which eliminates the outbound trackback response parser.
XML external entity (XXE) processing in Apache Roller 6.1.5 allows an authenticated weblog administrator to read files accessible to the Roller process and to reach internal network addresses by importing a crafted OPML bookmark document, because the bookmark-import parser does not disable external entity resolution. The advisory confirms no non-default configuration is required - the administrator bookmark-import action is vulnerable out of the box on the affected release - which is consistent with the assessed CVSS 3.1 score of 7.7 High (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, scope changed, confidentiality-only impact). No public exploit code and no confirmed active exploitation have been identified at time of analysis; the issue is remediated in Apache Roller 6.1.6, which uses a hardened parser that disables external entities and document type declarations.
XML External Entity (XXE) injection in http4s-scala-xml's EntityDecoder for scala.xml.Elem (all versions before 0.24.1 and 1.0.0-M39) allows unauthenticated remote attackers who can supply XML message bodies to disclose files readable by the service process, perform server-side request forgery (SSRF) against internal network resources, or trigger denial of service via entity expansion. The decoders obtain a javax.xml.parsers.SAXParserFactory through SAXParserFactory.newInstance without configuring secure-processing features, so JDK default behavior resolves DOCTYPE declarations, external general and parameter entities, and external DTDs. Vendor-released fixes are 0.24.1 and 1.0.0-M39; no public exploit code has been identified at time of analysis, and reachability depends on an application actually using these decoders against untrusted XML.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read files and reach resources outside the application's security scope by submitting crafted XML to an XML-processing function (CWE-611 XML external entity injection). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N rates this 7.7 High: confidentiality impact is high with a scope change, but there is no integrity or availability effect, meaning the outcome is data exposure rather than code execution or service disruption. Exploitation requires a valid low-privilege DataStage account and network reachability to the affected XML handling surface; no user interaction is needed, and no public exploit identified at time of analysis. Patch available per vendor advisory (IBM support page node/7288649).
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.