fonttools XML External Entity Injection (XXE) Vulnerability

Summary As of fonttools=4.28.2 the subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the...

Qualys Jenkins Plugin for WAS XML External Entity vulnerability

Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize t...

Qualys Jenkins Plugin for Policy Compliance XML External Entity vulnerability

Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs...

GHSA-8525-52VG-JV6V Qualys Jenkins Plugin for Policy Compliance XML External Entity vulnerability

Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs...

CVE-2023-6149

Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize t...

CVE-2023-6147

Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs...

Jenkins Plugin Qualys Code Issue Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2023-6147: Improper Restriction of XML External Entity Reference

Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs...

CVE-2023-26999: Improper Restriction of XML External Entity Reference

An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file...

Jenkins Plugin Qualys Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Qualys Jenkins Plugin Code Issue Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is a software application. A code issue vulnerability...

PT-2024-13215

Name of the Vulnerable Software and Affected Versions fontTools versions 4.28.2 through 4.42.1 Description The subsetting module in fontTools has a XML External Entity Injection XXE vulnerability, allowing an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts containing a S...

MAL-2024-40 Malicious code in bakery-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a8e5bc15b6be0a7b0cb44ca4ad86f63a0b563af9160ffe245052f833f3e02ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-35 Malicious code in axis-common-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d46e6aa49acd26b8f52fc1e1d11ffa3fb20d5efa8e9648fb414a0c25aaa81480 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-29 Malicious code in warbeast2000 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3f9238061e04c025429d5d714dcb96fd9276ee820fd4bfaa3eeae959ff105d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in matomo-looker-studio-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8882cb12f515121a2bb1a68d29a247d90b65f5a85e13154e1ed8988e0c4bbcf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-16 Malicious code in get_name_of_token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6b5dfc1df3f6f7257bc6a0ffb95fad3de4cde82911c81d5f21f1d8b70d05d6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9 Malicious code in @msmg-money/get-current-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fc0472c5df497035ba44d0a77a71996819e8234defd28002ebdc7079ff477ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8773 Malicious code in holland (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7126f7b736ad37c767545428db7c071735738d8ae229e34b18808054f175e6ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord.js-selbotderank (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5260eb5b081fbed08c3915d652632aed1e6899f2bca15853a142f45cf5b35c34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...