PT-2023-28883 · Unknown · Cx-Designer

Name of the Vulnerable Software and Affected Versions: CX-Designer versions 3.740 and earlier Description: The issue concerns an improper restriction of XML external entity reference XXE vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information ...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Zabbix vulnerabilities (USN-4767-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4767-1 advisory. Fu Chuang discovered that Zabbix did not properly parse IPs. A remote attacker could possibly use this issue to execute arbitrary...

Fedora 38 : python2.7 (2023-348a0dbcf3)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-348a0dbcf3 advisory. Security fix for CVE-2022-48565. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

svg_optimizer rubygem external XML entity (XXE) vulnerability

An issue in Fnando svgoptimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content...

GHSA-6HVG-62Q8-95V7 svg_optimizer rubygem external XML entity (XXE) vulnerability

An issue in Fnando svgoptimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content...

XML External Entity (XXE) Injection

Overview svgoptimizer is a SVG optimization based on Node's SVGO Affected versions of this package are vulnerable to XML External Entity XXE Injection when optimizing untrusted SVG content. An attacker can escalate privileges by exploiting the external XML entity XXE vulnerability. This is only...

Ubuntu 16.04 ESM : Coin3D vulnerability (USN-4825-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4825-1 advisory. USN-3356-1 fix a vulnerability in Expat. This update provides the corresponding update for Coin3D for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted...

Atlassian JIRA Service Desk < 4.20.26 / 5.4.x < 5.4.10 / 5.5.x < 5.7.2 / 5.8.x < 5.8.2 / 5.9.x < 5.9.2 / 5.10.x < 5.10.1 (JSDSERVER-14401)

The version of Atlassian JIRA Service Desk Server running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-14401 advisory. - XXE XML External Entity Injection in Jira Service Management Data Center and Server - CVE-2019-13990 CVE-2019-13990 Note that Nessus has not...

php: XML loading external entity without being enabled

A flaw was found in PHP due to inadequate validation of user-supplied XML input. By leveraging specially crafted XML code, a remote attacker could obtain sensitive information by viewing the contents of arbitrary files on the system or initiating requests to external systems. This issue may allow...

php: XML loading external entity without being enabled

A flaw was found in PHP due to inadequate validation of user-supplied XML input. By leveraging specially crafted XML code, a remote attacker could obtain sensitive information by viewing the contents of arbitrary files on the system or initiating requests to external systems. This issue may allow...

RHEL 9 : php (RHSA-2023:5926)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5926 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: XML loading external entity witho...

External XML entity (XXE) vulnerability in svg_optimizer rubygem

An issue in Fnando svgoptimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content...

CVE-2023-45727

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity XXE attacks. By processing a specially crafted request containing...

CVE-2023-45727

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity XXE attacks. By processing a specially crafted request containing...

CVE-2023-45727

CVE-2023-45727 affects Proself Enterprise/Standard Edition v5.62 and earlier, Proself Gateway Edition v1.65 and earlier, and Proself Mail Sanitize Edition v1.08 and earlier. A remote unauthenticated attacker can trigger an XML External Entity (XXE) processing flaw by sending carefully crafted XML...

Improper restriction of XML external entity references (XXE) in Proself

Overview Proself provided by North Grid Corporation improperly restricts XML external entity references XXE CWE-611. The developer states that attacks exploiting this vulnerability have been observed. North Grid Corporation reported this vulnerability to JPCERT/CC to notify users of its solution...

Proself Code Issue Vulnerability

Proself is an application from Proself, Inc. A security vulnerability exists in some Proself products. An attacker could exploit the vulnerability to perform an XML External Entity XXE attack, which could read arbitrary files containing account information on the server. The following products an...

CVE-2022-22380

IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID: 221957...

CVE-2022-22380

IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID: 221957...

CVE-2022-22380: Improper Certificate Validation

IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID: 221957...