https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:33:34 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-11297 bdu:2024-11297 https://cve.radiocsirt.org/vuln/bdu:2024-11297 https://cve.radiocsirt.org/vuln/euvd-2026-207095 EUVD-2026-207095 https://cve.radiocsirt.org/vuln/euvd-2026-207095 https://cve.radiocsirt.org/vuln/fkie_cve-2024-55887 <p>Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted.</p> <p>Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-55887 https://cve.radiocsirt.org/vuln/ghsa-w9j7-phm3-f97j <p><strong>Affected:</strong> Maven: org.fhir:ucum</p> <p>### Impact XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML.</p> <p>### Patches Release 1.0.9 of ucum fixes this vulnerability</p> <p>### Workarounds Ensure that the source xml for instantiating UcumEssenceService is trusted.</p> <p>### References * https://cwe.mitre.org/data/definitions/611.html * https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j</p> <p><strong>Affected:</strong> Maven: org.fhir:ucum</p> <p>### Impact XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML.</p> <p>### Patches Release 1.0.9 of ucum fixes this vulnerability</p> <p>### Workarounds Ensure that the source xml for instantiating UcumEssenceService is trusted.</p> <p>### References * https://cwe.mitre.org/data/definitions/611.html * https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j</p> https://cve.radiocsirt.org/vuln/ghsa-w9j7-phm3-f97j