https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:50:58 +0000 https://cve.radiocsirt.org/vuln/cve-2024-52007 <p><strong>Affected:</strong> hapifhir org.hl7.fhir.core, hapifhir hl7_fhir_core</p> <p>HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( &lt;!DOCTYPE foo [&lt;!ENTITY example SYSTEM &#34;/etc/passwd&#34;&gt; ]&gt; could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 &amp; #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p><strong>Affected:</strong> hapifhir org.hl7.fhir.core, hapifhir hl7_fhir_core</p> <p>HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( &lt;!DOCTYPE foo [&lt;!ENTITY example SYSTEM &#34;/etc/passwd&#34;&gt; ]&gt; could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 &amp; #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/cve-2024-52007