CVE-2024-28109

HIGH Year: 2024
CVSS v3 Score
8.1
High
Weakness Type
CWE-91
View all →

Vulnerability Description

veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.

Related Vulnerabilities

CVE-2019-0268

HIGH
CVSS:8.1(High)

SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source.

CWE-912019

CVE-2022-22784

HIGH
CVSS:8.1(High)

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of ...

CWE-912022

CVE-2024-47113

HIGH
CVSS:8.1(High)

IBM ICP - Voice Gateway 1.0.2, 1.0.2.4, 1.0.3, 1.0.4, 1.0.5, 1.0.6. 1.0.7, 1.0.7.1, and 1.0.8 could allow remote attacker to send specially crafted XML statements, which would allow them to attacker t...

CWE-912024

CVE-2025-25589

HIGH
CVSS:8.1(High)

An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

CWE-912025

CVE-2020-6271

HIGH
CVSS:8.2(High)

SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the system to crash and rea...

CWE-912020

CVE-2022-2458

HIGH
CVSS:8.2(High)

XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an ...

CWE-912022