MAL-2023-8708 Malicious code in discord.js-unofficial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2cfb5f5169ea123ccc46368108dd1e9dc29b9a693076f78222663d3de02c2bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8704 Malicious code in blingbling-dasda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46ed500c1c71ca63e8e0f525af316a734b58409740e27e1e80b8065e341ecc9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-CR8H-FR86-8VFV WSO2 products vulnerable to XML External Entity attack

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity XXE attack abuses a widely available but rarely used feature of XML parsers to access sensitive information...

WSO2 products vulnerable to XML External Entity attack

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity XXE attack abuses a widely available but rarely used feature of XML parsers to access sensitive information...

CVE-2023-6836

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity XXE attack abuses a widely available but rarely used feature of XML parsers to access sensitive information...

Xxe

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity XXE attack abuses a widely available but rarely used feature of XML parsers to access sensitive information...

CVE-2023-6836

CVE-2023-6836 refers to an XML External Entity (XXE) vulnerability affecting multiple WSO2 products (notably WSO2 API Manager). The underlying issue is an XML parser feature that can be abused to access sensitive information. The CVSS data in the initial document shows a high impact with network ...

CVE-2023-6836

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity XXE attack abuses a widely available but rarely used feature of XML parsers to access sensitive information...

WSO2 API Manager Security Vulnerability

WSO2 API Manager is an API lifecycle management solution from WSO2, Inc. A security vulnerability exists in WSO2 API Manager that stems from an XML external entity injection vulnerability...

CVE-2023-6836: Improper Restriction of XML External Entity Reference

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity XXE attack abuses a widely available but rarely used feature of XML parsers to access sensitive information...

MAL-2023-8699 Malicious code in web3-core-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29bb5d3d302e021e8dddaaafa92aa8444f3496917be02b290087b0c9bd4c4b54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8696 Malicious code in @gtfobar/pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29393b755fc68b86e17f968b750991f19288e7bd3b74adc485ba0ad947aac5ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jenkins Nexus Platform Plugin missing permission check

Jenkins Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. Additionally, the plugin does not...

CVE-2023-6721

An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system...

PYSEC-2023-296

An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system...

PYSEC-2023-296

An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system...

PT-2023-31635 · Jenkins · Jenkins Nexus Platform Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML. The plugin does not...

PT-2023-31636 · Jenkins · Jenkins Nexus Platform Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier Description: The issue is related to missing permission checks in the Jenkins Nexus Platform Plugin, allowing attackers with Overall/Read permission to send an HTTP request to an...

CSRF vulnerability and missing permission checks in Nexus Platform allow XXE

Nexus Platform 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. Additionally, the plugin does not configure its X...

Repox Code Issues Vulnerabilities

Repox is a framework for managing data spaces from Repox. A code issue vulnerability exists in Repox 2.3.7 and earlier versions, which stems from the presence of an XML External Entity Injection XXE vulnerability. An attacker can exploit this vulnerability to upload malicious XML data via the...