MAL-2023-8612 Malicious code in minotari_wallet_ff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48f015d501f7fda235545da39cb174ad6dfd4de2416ecb639a39644fd44618b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to server-side request forgery due to Eclipse Jetty (261776)

Summary IBM Sterling Connect:Direct Browser User Interface uses Eclipse Jetty server. Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. By...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to server-side request forgery due to Eclipse Jetty (261776)

Summary IBM Sterling Connect:Direct Web Services uses Eclipse Jetty. Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. By sending a specially...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to XML external entity injection due to Eclipse Jetty (260681)

Summary IBM Sterling Connect:Direct Web Services uses Eclipse Jetty. Vulnerability Details IBM X-Force ID: 260681 DESCRIPTION: Eclipse Jetty is vulnerable to an XML external entity injection XXE attack when processing XML data, caused by a weakly configured XML parser. By using specially crafted...

PT-2023-8772

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to insufficient bounds control in the drm sched entity init function within the Linux kernel's DRM driver. This could potentially allow an attacker to impact the...

XML External Entity (XXE)

svgoptimizer is vulnerable to XML external entity XXE . The vulnerability exists due to allowing XXE by default in svgoptimizer.rb which could allow an attacker to escalate privileges...

MAL-2023-8594 Malicious code in areweplayingyet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc131f3b217a186c1278c0f623cbc243ac04894e5fed716f5ecdce60a27b3944 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8595 Malicious code in arubawebappbackend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13e80ca401e27abd48a78b1577012b1f0eb9ac284b98ca33db5eb920ce9ab41b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to multiple vulnerabilities due to Jetty

Summary IBM Sterling Connect:Direct Browser User Interface uses Jetty server. Vulnerability Details IBM X-Force ID: 260681 DESCRIPTION: Eclipse Jetty is vulnerable to an XML external entity injection XXE attack when processing XML data, caused by a weakly configured XML parser. By using specially...

Security Bulletin: Multiple security vulnerabilities in Snake YAML affect IBM Sterling B2B Integrator

Summary IBM Sterling B2B Integrator uses Snake YAML. Vulnerability Details CVEID: CVE-2017-18640 DESCRIPTION: SnakeYAML is vulnerable to a denial of service, caused by an entity expansion in Alias feature during a load operation. By sending a specially crafted request, a remote attacker could...

MAL-2023-8549 Malicious code in wehackreposss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 886efcb413ccb918dc087a951fa61416e8b1175b0ea3009a4e273b62067fe385 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Linux 8 : qt5-qtbase (ELSA-2023-6967)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6967 advisory. - Fix infinite loops in QXmlStreamReader CVE-2023-38197 Resolves: bz2222770 - Don't allow remote attacker to bypass security restrictions caused by fla...

VulnCheck KEV: CVE-2011-3600

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figur...

Malicious code in cobrowse-visitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfe866d98bd76a71b60029f68eefcd3158b2870ec3cf49a37fda9efa17fd05bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8543 Malicious code in customer-journey-socket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8611ae83fb22fa782fc27b23da9fb90fe5956c5e0008d94818de724f3c6b60c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-8HCR-5X2G-9F7J Deserialization of Untrusted Data in apache-submarine

Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests using application/yaml content-type, it defin...

Adobe RoboHelp Server < 11.5 Multiple Vulnerabilities (APSB23-53)

Adobe RoboHelp Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:robohelpserver"...

MAL-2023-8533 Malicious code in xpub-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc3e9ded369fe8fed74a7f23ab0c33cbbda2a1e16aab8c2283faba59903c49d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Adobe RoboHelp Server < 11 Update 5 Multiple Vulnerabilities (APSB23-53)

The version of Adobe RoboHelp Server installed on the remote host is prior to 11 Update 5. It is, therefore affected by multiple vulnerabilities: - XML external entity XXE vulnerability. CVE-2023-22274 - Information disclosure due to a memory leak. CVE-2023-22272 - Path traversal vulnerability...

Adobe RoboHelp Security Vulnerability

Adobe RoboHelp is a software application from Adobe, Inc. Next-generation software for authoring and publishing help, strategy and knowledge base content. A security vulnerability exists in Adobe RoboHelp version 11.4 and prior versions, which stems from the presence of an XML External Entity...