漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Ucum-java has an XXE vulnerability in XML parsing
Vulnerability Description
Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Vulnerability Title
Ucum-java 代码问题漏洞
Vulnerability Description
Ucum-java是FHIR开源的一个提供 Ucum 服务的 FHIR Java 库。 Ucum-java 1.0.9之前版本存在代码问题漏洞，该漏洞源于UcumEssenceService执行的XML解析容易受到XML外部实体注入的攻击，导致外部客户端可以提交XML。
CVSS Information
N/A
Vulnerability Type
N/A