{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-24T18:49:41.172","vulnerabilities":[{"cve":{"id":"CVE-2018-1000889","sourceIdentifier":"cve@mitre.org","published":"2018-12-28T16:29:02.050","lastModified":"2026-06-17T01:33:16.093","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java) that can result in information leak, possible RCE depending on system configuration. This attack appears to be exploitable via the victim opening a specially crafted circuit file. This vulnerability appears to have been fixed in 2.14.4."},{"lang":"es","value":"Logisim Evolution, en versiones 2.14.3 y anteriores, contiene una vulnerabilidad XEE (XML External Entity) en la funcionalidad de carga de archivos Circuit (loadXmlFrom en src/com/cburch/logisim/file/XmlReader.java) que puede resultar en la fuga de información y una posible ejecución remota de código, dependiendo de la configuración del sistema. El ataque parece ser explotable si una víctima abre un archivo circuit especialmente manipulado. La vulnerabilidad parece haber sido solucionada en la versión 2.14.4."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-611"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:logisim-evolution_project:logisim-evolution:*:*:*:*:*:*:*:*","versionEndIncluding":"2.14.3","matchCriteriaId":"3D70F429-0F6E-49C9-BC2D-2DA11D6BE98B"}]}]}],"references":[{"url":"https://github.com/reds-heig/logisim-evolution/pull/139","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://www.kvakil.me/posts/logisim/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/reds-heig/logisim-evolution/pull/139","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.kvakil.me/posts/logisim/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}