Security Bulletin: IBM WebSphere Application Server is vulnerable to an XML External Entity Injection (XXE) vulnerability (CVE-2024-45072)

Summary IBM WebSphere Application Server is vulnerable to an XML External Entity Injection XXE in the administrative console. Vulnerability Details CVEID:CVE-2024-45072 DESCRIPTION: IBM WebSphere Application Server is vulnerable to an XML External Entity Injection XXE attack when processing XML...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Unauthenticated XML External Entity (XXE) vulnerability

Unauthenticated XML External Entity XXE vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

Security Bulletin: IBM B2B Advanced Communications is vulnerable to issues due to Data Mapper for Jackson

Summary IBM B2B Advanced Communications has addressed vulnerabilities in Data Mapper for Jackson shipped with product. Vulnerability Details CVEID:CVE-2019-10172 DESCRIPTION: Jackson-mapper-asl could allow a remote attacker to obtain sensitive information, caused by an XML external entity XXE err...

MAL-2024-9458 Malicious code in monday-react-quickstart-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eeeade5f5aa91633c87be63e8346db1068379e848dc4eee6832107dbb9f96cf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9455 Malicious code in csm-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64d16c1d6eb0822be5e65caced92f56b1f6160e2fafc6343c11694ce4eca80c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM WebSphere Application Server traditional shipped with IBM Tivoli System Automation Application Manager is vulnerable to an XML External Entity Injection (XXE) vulnerability

Summary A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager CVE-2024-45072 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affect...

CVE-2023-49570

A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant ...

CVE-2023-49570 Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210)

A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant ...

MAL-2024-9433 Malicious code in jungle-db (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4da3fed264588f5c8f7d67b38a5bc2eeab345106c1b087c0ca7a369806fab9bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jungle-db (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4da3fed264588f5c8f7d67b38a5bc2eeab345106c1b087c0ca7a369806fab9bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-13750 · Bitdefender · Bitdefender Total Security

Name of the Vulnerable Software and Affected Versions: Bitdefender Total Security versions prior to the latest version Description: A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't...

Schneider Electric EcoStruxure Data Center Expert XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric EcoStruxure Data Center Expert. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the exportSvg method. Due to...

Magento / Adobe Commerce Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CosmicSting: Magento Arbitrary File Read CVE-2024-34102 + PHP Buffer Overflow in the iconv function of glibc CVE-2024-2961', 'Description' = %q...

Dell AppSync Server XML External Entity Injection Vulnerability

Dell AppSync Server is a copy data management software from Dell USA. An XML external entity injection vulnerability exists in Dell AppSync Server versions 4.3 through 4.6, which arises from a networked system or product that does not have the correct filters in place to allow references to...

IBM WebSphere Application Server XML External Entity Injection Vulnerability (CNVD-2024-43189)

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. An XML external entity injection vulnerability exists in...

MAL-2024-9316 Malicious code in 844b5t (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c94eb1a3b22cc1d70762d22b1b4267f152ebd42f59622a80427938d470e946ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gvjtly (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca5bed858b30f81e55f21887add0cd3d3d1820054f304dbb5ee451b6b429031b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9309 Malicious code in 4i0g5z (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5390faef7b52768e7f8ed29f34450931d8cbeaa66f1dd41be9db13a71ff9b9da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9315 Malicious code in 7qt8hl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbd79d7a9dbbe62f3ddb18022c026a13ce104cd8164073cf50519b6ee8f2922b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9314 Malicious code in 7phpfm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9995a61732fac32b87d87296bb2f8b533c0eff6b2736b0bc641bee8e79f2a43f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...