CVE-2023-0871 An XML External Entity injection vulnerability

XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity XXE injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution...

CVE-2023-0871

Affected product: OpenNMS Horizon (OpenNMS Horizon). Vulnerability: XXE injection in the /rtc/post/ endpoint. Root cause: XML external entity handling allows an attacker to cause Horizon to fetch arbitrary resources. Versions affected: Horizon 31.0.8 and earlier than 32.0.2 on multiple platforms....

CVE-2023-0871 An XML External Entity injection vulnerability

XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity XXE injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution...

MAL-2023-1447 Malicious code in hsqwe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6af02b8a41a1ba2a2897c59a9bfe66780bc83afc705127d53c22c2d463c74bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1446 Malicious code in horaw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a180f896e2dd432d2280836c5441fce0ad50a403d3c7f2e6340a91addaabf9b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-3823 Security issue with external entity loading in XML without enabling it

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling...

MAL-2023-1445 Malicious code in fiji-core-pal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b28ba0a33259d58a30bc38f6d3444c0677f33e3eda42538f3a1114a9191e7ce0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-3823: Improper Restriction of XML External Entity Reference

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling...

PT-2023-16575 · Opennms · Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Horizon versions 31.0.8 through 32.0.2 Description: The issue is related to an XML external entity XXE injection vulnerability in the /rtc/post/ endpoint, which can be used to force Horizon to make arbitrary HTTP requests to internal...

PHP Code Issues Vulnerabilities

PHP is a scripting language for PHP that executes on the server side. PHP suffers from a code issue vulnerability that stems from loading external entities without XML enabled, resulting in a local file disclosure. Affected products and versions: PHP version 8.0 prior to 8.0.30, version 8.1 prior...

CVE-2023-32567

Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236...

CVE-2023-32567

Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236...

CVE-2023-32567

Ivanti Avalanche contains an XXE-related vulnerability in the decodeToMap XML processing, enabling potential information disclosure in affected installations. The issue stems from improper handling of XML External Entity references within the decodeToMap method. Public advisories (ZDI-23-1167) de...

CVE-2023-32567

Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236...

CVE-2023-32567

Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236...

MAL-2023-1438 Malicious code in exp-core-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31032b8597c788373193761b90d13ba7f409a33d3a75f62a7ee5ba4e4ff9804e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1439 Malicious code in fca-jordan-amiir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f3b3ab4084f3845b39090f0a666fb9b5fb6898b09d11d28e4d1a25fd63e3cc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1441 Malicious code in react-native-transparent-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfc4c56c3c11c9b9f70d9cc95f941b8549be2b5b18c367c51ed8d531cb0f2ca6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-32567: Improper Restriction of XML External Entity Reference

Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236...

PT-2023-23878 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.1.236 Description: The issue concerns XML External Entity Processing in the decodeToMap function of Ivanti Avalanche, which can lead to information disclosure. Recommendations: For versions prior to...