https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 08:06:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-26529 EUVD-2026-26529 https://cve.radiocsirt.org/vuln/euvd-2026-26529 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29620 <p>Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.</p> <p>Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-29620 https://cve.radiocsirt.org/vuln/ghsa-24wf-7vf2-pv59 <p><strong>Affected:</strong> Maven: com.epam.reportportal:service-api</p> <p>### Impact Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.</p> <p>### Patches Fixed with: https://github.com/reportportal/service-api/pull/1392</p> <p>### Binaries `docker pull reportportal/service-api:5.4.0` https://github.com/reportportal/service-api/packages/846871?version=5.4.0</p> <p>### For more information If you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)</p> <p><strong>Affected:</strong> Maven: com.epam.reportportal:service-api</p> <p>### Impact Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.</p> <p>### Patches Fixed with: https://github.com/reportportal/service-api/pull/1392</p> <p>### Binaries `docker pull reportportal/service-api:5.4.0` https://github.com/reportportal/service-api/packages/846871?version=5.4.0</p> <p>### For more information If you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)</p> https://cve.radiocsirt.org/vuln/ghsa-24wf-7vf2-pv59 https://cve.radiocsirt.org/vuln/gsd-2021-29620 gsd-2021-29620 https://cve.radiocsirt.org/vuln/gsd-2021-29620