PT-2024-6096

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.6.3 Description The issue is related to a problem in the libexpat library, which is used for parsing XML files. It is caused by the library's failure to properly restrict references to external XML entities. This c...

CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been...

MAL-2024-8059 Malicious code in lodash-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9f3565f115c4b58b6ebacb1536e206aa7c84c9f3a0c73b0ebe5628ae94d0546 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8054 Malicious code in @mp-ss-promotions-lib/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3aa7f38eaa1d9a14789ef8ced25b4c36bad2a99d21d0f2ef8a92e214ce781b44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8052 Malicious code in @costs-components-ui/costs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ece207d1ff381cbf6348d88e14e6f00be9e5e0dfb7a42589cdc2bbb55de054e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8063 Malicious code in side-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9233d92d37692726bc693958e27369fe68aa103372f8d54bc94628aa64e1bfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PhpSpreadsheet 安全漏洞

PhpSpreadsheet is an open source PHP library from PHPOffice for reading and writing spreadsheet files. A security vulnerability exists in PhpSpreadsheet that stems from the ability to bypass the XXE filter...

PT-2024-31399

Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 2.2.1 Description The issue allows for a bypassing of a filter, enabling an XXE-attack. This attack can obtain contents of local files, even if error reporting is muted. Technical details about exploitation...

Malicious code in telegram-con (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4423698d3e9c78a69cbb237d0f5e731fc3d3cb87d359523298398d8ef719c8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty may affect IBM Storage Scale (CVE-2024-25026, CVE-2024-22329, CVE-2024-22354)

Summary There are vulnerabilities in IBM WebSphere Application Server Liberty, used by IBM Storage Scale, which could allow a remote attacker to exploit and cause the server to consume memory resources and SSRF attack. Vulnerability Details CVEID:CVE-2024-22329 DESCRIPTION: IBM WebSphere...

MAL-2024-8037 Malicious code in prettier-config-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4241fd6088878cd356569ae38a56d91f4c9f0819334d7fdf2fd40546ea6143e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8038 Malicious code in solana-cctp-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f513aced5931ffb63f949f93cc61dfe8ceae696235caee3f926488e16d73de06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8036 Malicious code in platform-client-messaging-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c2d8c135637c1c5dabdcf9238f0a282f34540de11eca662db70ccadf8260ed8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8040 Malicious code in system-library-gameanalytics-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7c2f4730ced83dee1092ba6678be557ca2aabeb26a07593f183802984e4a903 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2024-2038 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview rexml is an An XML toolkit for Ruby. Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via tree parser APIs like REXML::Document.new function. An attacker can cause the application to consume excessive...

SUSE CVE-2022-48882

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix macsec possible null dereference when updating MAC security entity SecY Upon updating MAC security entity SecY in hw offload path, the macsec security association SA initialization routine is called. In case of...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a race condition issue in the reweightentity function that results in a null pointer dereference when the...

CVE-2024-43398: Improper Restriction of Recursive Entity References in DTDs

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

CVE-2022-48882

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix macsec possible null dereference when updating MAC security entity SecY Upon updating MAC security entity SecY in hw offload path, the macsec security association SA initialization routine is called. In case of...