https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:40:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-68579 EUVD-2026-68579 https://cve.radiocsirt.org/vuln/euvd-2026-68579 https://cve.radiocsirt.org/vuln/fkie_cve-2018-17198 <p>Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnerability exists even if Roller XML-RPC interface is disable via the Roller web admin UI. Mitigation: There are a couple of ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.2.2 2) Or, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping as shown below: &lt;!-- &lt;servlet-mapping&gt; &lt;servlet-name&gt;XmlRpcServlet&lt;/servlet-name&gt; &lt;url-pattern&gt;/roller-services/xmlrpc&lt;/url-pattern&gt; &lt;/servlet-mapping&gt; --&gt;</p> <p>Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnerability exists even if Roller XML-RPC interface is disable via the Roller web admin UI. Mitigation: There are a couple of ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.2.2 2) Or, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping as shown below: &lt;!-- &lt;servlet-mapping&gt; &lt;servlet-name&gt;XmlRpcServlet&lt;/servlet-name&gt; &lt;url-pattern&gt;/roller-services/xmlrpc&lt;/url-pattern&gt; &lt;/servlet-mapping&gt; --&gt;</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-17198 https://cve.radiocsirt.org/vuln/ghsa-38f5-5m8x-c6h5 <p>Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnerability exists even if Roller XML-RPC interface is disable via the Roller web admin UI. Mitigation: There are a couple of ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.2.2 2) Or, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping as shown below: &lt;!-- &lt;servlet-mapping&gt; &lt;servlet-name&gt;XmlRpcServlet&lt;/servlet-name&gt; &lt;url-pattern&gt;/roller-services/xmlrpc&lt;/url-pattern&gt; &lt;/servlet-mapping&gt; --&gt;</p> <p>Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnerability exists even if Roller XML-RPC interface is disable via the Roller web admin UI. Mitigation: There are a couple of ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.2.2 2) Or, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping as shown below: &lt;!-- &lt;servlet-mapping&gt; &lt;servlet-name&gt;XmlRpcServlet&lt;/servlet-name&gt; &lt;url-pattern&gt;/roller-services/xmlrpc&lt;/url-pattern&gt; &lt;/servlet-mapping&gt; --&gt;</p> https://cve.radiocsirt.org/vuln/ghsa-38f5-5m8x-c6h5 https://cve.radiocsirt.org/vuln/gsd-2018-17198 gsd-2018-17198 https://cve.radiocsirt.org/vuln/gsd-2018-17198