CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2021-23926

CVSS 9.1v3.1pub. 2021-01-14upd. 2024-11-21

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

  • Apache Xmlbeans

    APP
    Apache
    ≤ 2.6.0

  • Debian

    OS
    Debian
    9.0

  • Netapp Oncommand Unified Manager Core Package

    APP
    Netapp
    all versions

  • Netapp Snap Creator Framework

    APP
    Netapp
    all versions

  • Netapp Snapmanager

    APP
    Netapp
    all versions

  • Oracle Middleware Common Libraries And Tools

    APP
    Oracle
    12.2.1.3.012.2.1.4.0

  • Oracle Peoplesoft Enterprise Peopletools

    APP
    Oracle
    8.578.588.59
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2026-35273CRITICAL9.8⚠ KEVPL ✓same product

Pominięcie uwierzytelnienia w Oracle PeopleSoft PeopleTools (RCE/Takeover)

CVE-2026-24061CRITICAL9.8⚠ KEVPL ✓same product

GNU Inetutils telnetd: ominięcie uwierzytelnienia przez zmienną USER

CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓same product

Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)

CVE-2025-49113CRITICAL9.9⚠ KEVPL ✓same product

RCE przez deserializację PHP w Roundcube Webmail (parametr _from)

CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓same product

Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)