Security Bulletin: iText.jar in Tom Sawyer Perspective is vulnerable to XML External Entity

Summary iText.jar in Tom Sawyer Perspective is vulnerable to XML External Entity used by IBM Tivoli Network Manager ITNM IP Edition. Vulnerability Details CVEID:CVE-2017-9096 DESCRIPTION: iText PDF Library could allow a remote authenticated attacker to obtain sensitive information, caused by an X...

MAL-2023-36 Malicious code in @esmpfrontend/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2edaa6244ce4a0413da9f30fb0702f0e5ddd8dfd4d35ae03f9de1f4a815061d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-Site Scripting (XSS)

phpmyfaq is vulnerable to Cross-Site Scripting XSS attacks. The library contains a stored XSS in the Field Name category which does not properly escape before it output to the front end due to missing HTML entity conversions, which allows an attacker to execute malicious JavaScript on victim's...

MAL-2023-646 Malicious code in oc-active-conversation-module-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af2f6d15b247e3f8fc944ad0ec5d9efe55a5163b89f729f53e819289a9102e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Amazon Linux 2 : pki-core (ALAS-2023-2016)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2016 advisory. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending...

Important: pki-core

Issue Overview: Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. CVE-2022-2414 Affected Packages: pki-core Note:...

Improper restriction of XML external entity references (XXE) in Shinseiyo Sogo Soft

Overview Shinseiyo Sogo Soft provided by The Ministry of Justice improperly restricts XML external entity references XXE CWE-611. Taku Toyama of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...

JVN#73178249: Improper restriction of XML external entity references (XXE) in Shinseiyo Sogo Soft

Shinseiyo Sogo Soft provided by The Ministry of Justice improperly restricts XML external entity references XXE CWE-611. Impact By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker. Solution Update the Software Update the software to the latest...

ROS-20230419-01

Vulnerability of HFS+ partition file analyzer of ClamAV antivirus software package is related to an operation exceeding the memory buffer boundaries. operation beyond the memory buffer boundaries. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

Shinseiyo Sogo Soft code-related vulnerabilities

Shinseiyo Sogo Soft is a software used by Japan's Ministry of Justice to process legal documents and information. A security vulnerability exists in Shinseiyo Sogo Soft version 7.9A and prior versions, which arises from incorrectly restricting XML external entity references...

SUSE CVE-2019-3773

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

MAL-2023-769 Malicious code in sendgram (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd1d8d9e7fe2d4bb63225ef26a1816cb63b8e72a92666345be028bff4abf77fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

Xxe

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

PT-2023-13658 · Güralp · Güralp Man-Eam-0003

Name of the Vulnerable Software and Affected Versions: Güralp MAN-EAM-0003 version 3.2.4 Description: The issue is related to an XML External Entity XXE problem via XML file upload, which can lead to local file disclosure. This occurs in the cgi-bin/xmlstatus.cgi component. Recommendations: For...

EUVD-2022-41399

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

Security Bulletin: Vulnerabilities in libxml2 affect IBM Integrated Management Module (IMM) for System x & BladeCenter

Summary IBM Integrated Management Module IMM for System x & BladeCenter has addressed the following vulnerabilities in libxml2. Vulnerability Details Summary IBM Integrated Management Module IMM for System x & BladeCenter has addressed the following vulnerabilities in libxml2. Vulnerability...

FreeBSD : py39-OWSLib -- arbitrary file read vulnerability (e5d117b3-2153-4129-81ed-42b0221afa78)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e5d117b3-2153-4129-81ed-42b0221afa78 advisory. - OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service...