SUSE CVE-2023-4218

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

MAL-2023-8499 Malicious code in vtex-toolbelt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0667be5f3afa2cd95762d584c729cd38dd39ca8d11bbd7d353a5aecf3f944334 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vader-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f1011ad5820edf4133971eeebc94ab36b715c17b0f12059f941506ec89ec64e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2023-4218

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

CVE-2023-4218 XXE in eclipse.platform / Eclipse IDE

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

PT-2023-28286 · Eclipse +2 · Eclipse Ide +2

Name of the Vulnerable Software and Affected Versions: Eclipse IDE versions prior to 2023-09 4.29 Description: The issue concerns the parsing of XML content in certain files, making them vulnerable to XXE attacks. This can occur when a user opens a malicious project or updates an open project wit...

Eclipse IDE code problem vulnerability

Eclipse IDE is a cross-platform open source integrated development environment from the Eclipse Foundation of Canada. A security vulnerability exists in versions of Eclipse IDE prior to 2023-09 4.29, which stems from the fact that certain files containing xml content are susceptible to a variety ...

CVE-2023-4218: Improper Restriction of XML External Entity Reference

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

DRUPAL-CONTRIB-2023-050

This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately verify whether a given user has the necessary permissions to access an entity's label creating an access bypass vulnerability. This vulnerability is mitigated by the fact that enti...

GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2023-050

This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately verify whether a given user has the necessary permissions to access an entity's label creating an access bypass vulnerability. This vulnerability is mitigated by the fact that enti...

CVE-2023-5136: Improper Restriction of XML External Entity Reference

An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file...

MAL-2023-8479 Malicious code in rb-seatlayout-canvas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab7073e8386662ab584a412e7d011050e505dea8df14c0e5273606bf0a823ae1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Rocky Linux 9 : libxml2 (RLSA-2023:0338)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0338 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several...

Fedora 39 : python2.7 (2023-ea38857cc3)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ea38857cc3 advisory. Security fix for CVE-2022-48565. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Rocky Linux 8 : qt5-qtbase and qt5-qtwebsockets (RLSA-2020:4690)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4690 advisory. - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue t...

Rocky Linux 8 : prometheus-jmx-exporter (RLSA-2020:4807)

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2020:4807 advisory. - The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. CVE-2017-18640 Note that Nessus h...

RHEL 9 : qt5 (RHSA-2023:6369)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6369 advisory. Qt is a software toolkit for developing applications. Security Fixes: qt: buffer over-read via a crafted reply from a DNS server...

SUSE: Security Advisory (SUSE-SU-2023:4367-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in share-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba664ab24090b0fcbea9d3c7c58134f47472535eba4ff9d4a65946aa5efad8ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8462 Malicious code in print-vault-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 367bf013409840485fdaebde8da15293906ece37c6c79fd8b03396935ac7a2a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...