20970 matches found
Huawei EulerOS: Security Advisory for libplist (EulerOS-SA-2024-1147)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-22024 (XXE) for Ivanti Connect Secure and Ivanti Policy Secure
Executive Summary: As part of the ongoing investigation, we discovered a new vulnerability as part of our internal review and testing of our code, which was also responsibly disclosed by watchTowr. This vulnerability only affects a limited number of supported versions – Ivanti Connect Secure...
EulerOS 2.0 SP5 : python (EulerOS-SA-2024-1160)
According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A use-after-free exists in Python through 3.9 via heappushpop in heapq. CVE-2022-48560 - An XML External Entity XXE issue was discovered in Pyth...
CentOS 8 : libxml2 (CESA-2023:0173)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:0173 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several...
apache-ivy: XML External Entity vulnerability
Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy...
Slackware Linux 15.0 / current expat Multiple Vulnerabilities (SSA:2024-038-01)
The version of expat installed on the remote host is prior to 2.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-038-01 advisory. - libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case...
Directory Traversal: Examples, Testing, and Prevention
Unveiling the Enigma of Path Navigation: An Exhaustive Exploration and Insight Path Navigation, often referred to as Folder Navigation, symbolizes a kind of security extraction point allowing unauthorized individuals to gain unauthorized access to specific files held within a server's database...
CVE-2023-52239
The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport...
SUSE CVE-2023-52426
libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...
CVE-2023-52426
A flaw was found in Expat libexpat. If XMLDTD is undefined at compile time, a recursive XML Entity Expansion condition can be triggered. This issue may lead to a condition where data is expanded exponentially, which will quickly consume system resources and cause a denial of service. Mitigation...
Magic xpi Integration Platform Security Vulnerability
Magic xpi Integration Platform is an integration platform from Magic designed to simplify integration between enterprise applications and systems. A security vulnerability exists in Magic xpi Integration Platform version 4.13.4. An attacker exploited the vulnerability to perform an xml external...
VulnCheck KEV: CVE-2024-22024
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...
PT-2024-14500 · Magic · Magic Xpi Integration Platform
Name of the Vulnerable Software and Affected Versions: Magic xpi Integration Platform version 4.13.4 Description: The XML parser in Magic xpi Integration Platform allows XXE attacks, for example, via onItemImport. Recommendations: For Magic xpi Integration Platform version 4.13.4, consider...
MAL-2024-965 Malicious code in ngpd-merceros-ui-meta (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b9c719bf14b04e4b0155b8641b63f83c3a854798e6f3038be2d9f6d25e73c3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-966 Malicious code in ngpd-merceros-ui-widget-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc889355fb898bd26e3457c596dcb5cac12554f84b9b1e98741c4e706b8b7b8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
IBM Security Access Manager XML External Entity Injection Vulnerability
IBM Security Access Manager is a product for information security management applications from International Business Machines IBM. The product enables access management control through integrated appliances for web, mobile and cloud computing. An XML external entity injection vulnerability exist...
DEBIAN-CVE-2023-52426
libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...
AZL-34684 CVE-2023-52426 affecting package expat for versions less than 2.6.2-1
libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...
