CVE-2023-37030

A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP Initial UE Message packet missing an expected eNBUES1APID field...

CVE-2023-37025

A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP Reset packet missing an expected ResetType field...

CVE-2023-37024

A reachable assertion in the Mobile Management Entity MME of Magma versions = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows remote attackers to crash the MME with an unauthenticated cellphone by sending a NAS packet containing an Emergency Number List Information...

CVE-2023-37026

A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP E-RAB Release Response packet missing an expected MMEUES1APID field...

CVE-2023-37027

Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP E-RAB Modification Indication packet missing an expected eNBUES1APID field...

CVE-2025-23195

An XML External Entity XXE vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the DocumentBuilderFactory class without disabling external entity resolution. An attacker can...

CVE-2025-23195 Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie

An XML External Entity XXE vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the DocumentBuilderFactory class without disabling external entity resolution. An attacker can...

CVE-2025-23195 Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie

An XML External Entity XXE vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the DocumentBuilderFactory class without disabling external entity resolution. An attacker can...

CVE-2025-23195 Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie

An XML External Entity XXE vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the DocumentBuilderFactory class without disabling external entity resolution. An attacker can...

MAL-2025-304 Malicious code in sdk-coin-algo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ea750c35c4bec1006a22374fd7f8e5a426522380aa5d0566f1c97875ad977b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-315 Malicious code in ui-components-highlight-vdom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c058680e21b489b3504441b59346650d2d8f204795eda46ba03d8c9585e58f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-components-highlight-vdom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c058680e21b489b3504441b59346650d2d8f204795eda46ba03d8c9585e58f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in calypso-eslint-overrides (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e56d5029c9f673038593248e7a19047892f45f4344d5a98af273acf9d2a358 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-37030

A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP Initial UE Message packet missing an expected eNBUES1APID field...

CVE-2023-37028

A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP E-RAB Modification Indication packet missing an expected eNBUES1APID field...

CVE-2023-37038

CVE-2023-37038 describes a null pointer dereference in Magma’s Mobile Management Entity (MME). The vulnerability affects Magma up to version 1.8.0 and allows network-adjacent attackers to crash the MME by sending an S1AP “Uplink NAS Transport” packet that omits the required MME_UE_S1AP_ID field. ...

PT-2025-1427 · Magma · Magma

Name of the Vulnerable Software and Affected Versions: Magma versions 1.8.0 and earlier Description: A Null pointer dereference issue in the Mobile Management Entity MME allows network-adjacent attackers to crash the MME via an S1AP "S1Setup Request" packet missing an expected Global eNB ID field...

CVE-2023-37026

The CVE-2023-37026 item affects Magma’s Mobile Management Entity (MME) and is caused by a null pointer dereference when handling an S1AP E-RAB Release Response packet missing the MME_UE_S1AP_ID field. Affected version: Magma

CVE-2023-37037

Magma's Mobile Management Entity (MME) contains a null pointer dereference in versions

CVE-2023-37024

A reachable assertion in the Mobile Management Entity MME of Magma versions = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows remote attackers to crash the MME with an unauthenticated cellphone by sending a NAS packet containing an Emergency Number List Information...