https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:04:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-107185 EUVD-2026-107185 https://cve.radiocsirt.org/vuln/euvd-2026-107185 https://cve.radiocsirt.org/vuln/fkie_cve-2013-4152 <p>The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.</p> <p>The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2013-4152 https://cve.radiocsirt.org/vuln/ghsa-rp4p-g69r-438x <p><strong>Affected:</strong> Maven: org.springframework:spring-oxm</p> <p>The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.</p> <p><strong>Affected:</strong> Maven: org.springframework:spring-oxm</p> <p>The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.</p> https://cve.radiocsirt.org/vuln/ghsa-rp4p-g69r-438x https://cve.radiocsirt.org/vuln/gsd-2013-4152 gsd-2013-4152 https://cve.radiocsirt.org/vuln/gsd-2013-4152 https://cve.radiocsirt.org/vuln/rhsa-2014:0212 <p>Java: XML signature spoofing Framework: XML External Entity (XXE) injection flaw</p> <p>Java: XML signature spoofing Framework: XML External Entity (XXE) injection flaw</p> https://cve.radiocsirt.org/vuln/rhsa-2014:0212 https://cve.radiocsirt.org/vuln/ubuntu-cve-2013-4152 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: libspring-java</p> <p>The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: libspring-java</p> <p>The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2013-4152