CVE-2024-12298: Improper Restriction of XML External Entity Reference

We found a vulnerability Improper Restriction of XML External Entity Reference CWE-611 in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer...

Entity Form Steps Module Drupal XSS

The vulnerability of the Entity Form Steps module in the Drupal CMS system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Drupal File Entity CMS XSS

The vulnerability of the Drupal File Entity CMS system is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and perform cross-site scripting attacks...

Malicious code in zqdl5551 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbd5f002e9be6ed643e4f041658ca89255b5c1a056c671f58ff4d1ef4257e908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Omron NB-Designer 代码问题漏洞

Omron NB-Designer is a programmable terminal software from Omron Corporation Japan. A code issue vulnerability exists in Omron NB-Designer V.1.63 and earlier versions, which stems from an improperly restricted XML external entity reference vulnerability that could be exploited by an attacker to...

DEBIAN-CVE-2024-49573

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...

UBUNTU-CVE-2024-49573

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...

CVE-2024-49573

CVE-2024-49573 relates to the Linux kernel scheduler (sched/fair.c). The fix patches NEXT_BUDDY handling in pick_next_entity() by moving clear_buddies() before the delayed dequeue logic and ensuring no new next buddy starts as delayed. This addresses a WARN triggered by enabling NEXT_BUDDY, with ...

CVE-2024-49573 sched/fair: Fix NEXT_BUDDY

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...

Security Bulletin: Due to use of IBM WebSphere Application Server, IBM Workload Automation is vulnerable to a server-side forgery attack,

Summary IBM WebSphere Application Server is used by IBM Workload Automation CVE-2024-22354 Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External...

CVE-2024-13305

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...

CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...

CVE-2024-13305

The Drupal Entity Form Steps module (versions before 1.1.4 ) is vulnerable to Cross-Site Scripting (XSS) due to the lack of protective measures for website structures and failure to escape plain text administrative configurations. A malicious actor with admin access and the 'administer [entity_ty...

CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...

CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...

CVE-2024-13276

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity fieldable files allows Forceful Browsing.This issue affects File Entity fieldable files: from 7.X- before 7.X-2.39...

CVE-2024-13276 File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity fieldable files allows Forceful Browsing.This issue affects File Entity fieldable files: from 7.X- before 7.X-2.39...

CVE-2024-13276 File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity fieldable files allows Forceful Browsing.This issue affects File Entity fieldable files: from 7.X- before 7.X-2.39...

CVE-2024-13276 File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity fieldable files allows Forceful Browsing.This issue affects File Entity fieldable files: from 7.X- before 7.X-2.39...

CVE-2024-13276

The File Entity (fieldable files) module in the Drupal CMS (versions 7.X-* before 7.X-2.39) is vulnerable to Forceful Browsing due to an Insertion of Sensitive Information Into Sent Data issue. The root cause is that the module fails to verify the existence of folders within the private destinati...