https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:42:11 +0000 https://cve.radiocsirt.org/vuln/cnvd-2017-05675 cnvd-2017-05675 https://cve.radiocsirt.org/vuln/cnvd-2017-05675 https://cve.radiocsirt.org/vuln/euvd-2026-73506 EUVD-2026-73506 https://cve.radiocsirt.org/vuln/euvd-2026-73506 https://cve.radiocsirt.org/vuln/fkie_cve-2017-5662 <p>In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.</p> <p>In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-5662 https://cve.radiocsirt.org/vuln/ghsa-qwgx-59jw-qfg9 <p><strong>Affected:</strong> Maven: org.apache.xmlgraphics:batik</p> <p>In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.</p> <p><strong>Affected:</strong> Maven: org.apache.xmlgraphics:batik</p> <p>In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.</p> https://cve.radiocsirt.org/vuln/ghsa-qwgx-59jw-qfg9 https://cve.radiocsirt.org/vuln/gsd-2017-5662 gsd-2017-5662 https://cve.radiocsirt.org/vuln/gsd-2017-5662 https://cve.radiocsirt.org/vuln/rhsa-2017:2546 <p>jasypt: Vulnerable to timing attack against the password hash comparison batik: XML external entity processing vulnerability jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper</p> <p>jasypt: Vulnerable to timing attack against the password hash comparison batik: XML external entity processing vulnerability jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper</p> https://cve.radiocsirt.org/vuln/rhsa-2017:2546 https://cve.radiocsirt.org/vuln/suse-su-2024:0777-1 <p>Security update for xmlgraphics-batik</p> <p>Security update for xmlgraphics-batik</p> https://cve.radiocsirt.org/vuln/suse-su-2024:0777-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-5662 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: batik, Ubuntu:Pro:16.04:LTS: batik</p> <p>In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: batik, Ubuntu:Pro:16.04:LTS: batik</p> <p>In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-5662 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0027 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen und nicht spezifizierte Auswirkungen zu verursachen.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen und nicht spezifizierte Auswirkungen zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0027