NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
oryginał ENCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HNsa Ghidra
APPNsa< 9.0.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
XXE
CWE
Powiązane podatności
CVE-2023-22671CRITICAL9.8ten sam produkt
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eva...
CVE-2019-16941CRITICAL9.8ten sam produkt
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML F...
CVE-2026-52750HIGH8.4ten sam produkt
Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd....
CVE-2026-49498HIGH8.7ten sam produkt
Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunct...
CVE-2026-52751HIGH8.6ten sam produkt
Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connecti...