20289 matches found
The vulnerability of the XMLParser component in the CI/CD application integration and delivery system of JetBrains TeamCity allows attackers to perform XXE attacks.
The vulnerability of the XMLParser component in the CI/CD application integration and delivery system of JetBrains TeamCity is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...
CVE-2024-40896
A flaw was found in libxml2. In the affected versions of libxml2, the SAX parser can generate events for external entities, even if custom SAX handlers try to override entity content by setting it to "checked." This vulnerability allows classic XML External Entity XXE attacks. Mitigation Mitigati...
AZL-54657 CVE-2024-40896 affecting package libxml2 for versions less than 2.11.5-2
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content by setting "checked". This makes classic XXE attacks possible...
CVE-2024-40896
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content by setting "checked". This makes classic XXE attacks possible...
The vulnerability of the strip_tags() function in the django.utils.html module of the Django software framework allows a attacker to cause a denial-of-service attack.
The vulnerability of the striptags function in the django.utils.html module of the Django software framework relates to unlimited resource allocation due to improper escaping of HTML characters. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending...
CVE-2024-56356
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack...
CVE-2024-56356
JetBrains TeamCity prior to 2024.12 is affected by an insecure XMLParser configuration that may permit XXE attacks. The root cause is improper handling of external entities in XML parsing, as described in multiple sources (including PT-2024-9791 and Red Hat). Impact is potential data exposure via...
PT-2024-9791 · Jetbrains · Jetbrains Teamcity +1
Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.12 Description: The issue is related to the XMLParser component in the JetBrains TeamCity system, which has an incorrect restriction on XML links to external objects. This can allow a remote attacker ...
CVE-2024-55470
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the...
CVE-2021-22501
Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability could be exploited to confidential information This issue affects Operations Bridge Manager: 2017.05, 2017.11, 2018.05, 2018.11, 2019.05,...
CVE-2021-22501
Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability could be exploited to confidential information This issue affects Operations Bridge Manager: 2017.05, 2017.11, 2018.05, 2018.11, 2019.05,...
CVE-2021-22501
Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability could be exploited to confidential information This issue affects Operations Bridge Manager: 2017.05, 2017.11, 2018.05, 2018.11, 2019.05,...
Security Bulletin: Multiple Vulnerabilities in IBM API Connect
Summary Multiple vulnerabilities were addressed in IBM API Connect v10.0.9.0 Vulnerability Details CVEID:CVE-2024-5535 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a buffer over-read flaw in the SSLselectnextproto API function when calling with an empty supported client...
XML External Entity (XXE)
Unstructured is vulnerable to XML External Entity XXE. The vulnerability is due to improper configuration while setting resolveentities=False for parsing XML with lxml in partitionxml, which allows external entities to be processed...
MAL-2024-11995 Malicious code in internallib_v420 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 291a2b6b3559f93316c3fa8d0ab9ddf6a6417051190512d339da5b8c5e5827cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in gps-gateway-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7841067a161c55356141a3d1e9fb8bd1922ff25291edeb0d46e708a9e6b563b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in eslint-config-extraterm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ac174483503687af78d8c768a2f9fa3abad4e982d193634c81b8870484ae360 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in nimiq-rewards-calculator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d950995f06dd02bfab4e652ede8b9806d3cdd50d46d63c8f03da915e20a25da2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in nerd4node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9212e7685c7fd13159cdd6b31f5c0b398be7266d6fcbab454def7f7d8fa1a781 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
