CWE-112.

Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

• Weak cryptography or TLS
• Authentication bypass

<=26.5.2 · no fixed version yet

Apache Struts 2 is Missing XML Validation

• XML external entities (XXE)
• CWE-112

>=2.0.0 · no fixed version yet

Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import

• SAP_SE SAP PowerDesigner Client
• CWE-112

HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction

• HCL Software HCL BigFix Mobile / Modern Client Management
• CWE-112

Missing XML Validation in Apache Tomcat

• CWE-112

<6.0.40 || >=7.0.0, <7.0.54 || >=8.0.0, <8.0.6 · fixed in 6.0.40, 7.0.54, 8.0.6

Missing XML Validation in Apache CXF

• CWE-112

>=2.5.0, <2.5.10 || >=2.6.0, <2.6.7 || >=2.7.0, <2.7.4 · fixed in 2.5.10, 2.6.7, 2.7.4

Missing XML Validation in Spring Framework

• CWE-112

<3.2.4.RELEASE · fixed in 3.2.4.RELEASE

Missing XML Validation in Apache Xerces2

• CWE-112

<2.12.0 · fixed in 2.12.0

SAP SE SAP BusinessObjects Business Intelligence Platform: When a user access SOAP Web services in SAP BusinessObjects Business Intelligence…

• SAP SE SAP BusinessObjects Business Intelligence Platform
• CWE-112

Cisco Web Security Appliance Privilege Escalation Vulnerability

• Cisco Web Security Appliance (WSA)
• CWE-112

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently un…

• Hamilton Medical AG, T1-Ventillator
• CWE-112

Missing XML Validation in PAN-OS Web Interface

• Palo Alto Networks PAN-OS
• CWE-112