JVN#37857022: Improper restriction of XML external entity references (XXE) in Applicant Programme

Applicant Programme provided by The Ministry of Justice improperly restricts XML external entity references XXE CWE-611. Impact By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker. Solution Update the Software Update the software to the latest...

PT-2023-9619 · Python · Python

Name of the Vulnerable Software and Affected Versions: Python versions prior to 3.9.1 Python cpython version 3.7 Python CPython 3.12.0b1 Description: An issue in the asyncio. swap current task component of Python allows an attacker to obtain sensitive information. The vulnerability is related to...

CVE-2023-32635

XBRL data create application version 7.0 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker...

Xxe

XBRL data create application version 7.0 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker...

CVE-2023-32635

XBRL data create application version 7.0 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker...

CVE-2023-32635

XBRL data create application version 7.0 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker...

Security Bulletin: IBM WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2023-27554)

Summary IBM WebSphere Application Server is vulnerable to an XML External Entity XXE Injection vulnerability. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-27554 DESCRIPTION: IBM WebSphere Application Server is vulnerable to an XML External Entity...

Improper restriction of XML external entity references (XXE) in XBRL data create application

Overview XBRL data create application provided by Financial Services Agency improperly restricts XML external entity references XXE CWE-611. Taku Toyama of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

JVN#44726469: Improper restriction of XML external entity references (XXE) in XBRL data create application

XBRL data create application provided by Financial Services Agency improperly restricts XML external entity references XXE CWE-611. Impact By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker. Solution Update the Software Update the software to the...

Financial Services Agency XBRL 代码问题漏洞

Financial Services Agency XBRL is a Financial Services Agency XBRL data creation application from the Financial Services Agency, Inc. of Japan. A security vulnerability exists in Financial Services Agency XBRL 7.0 and prior versions that stems from improperly restricting XML External Entity...

Security advisory: QXmlStreamReader

A recently reported potential buffer overflow issue in QXmlStreamReader has been assigned the CVE id CVE-2023-38197. QXmlStreamReader can freeze or get out of memory on recursive entity expansion, with DTD tokens in XML body. Solution: Apply the attached patch or update to Qt 5.15.15, Qt 6.2.10, ...

SUSE CVE-2023-38197

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion...

MAL-2023-514 Malicious code in identity-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51996f6a2e2b1701e5670d8d169328ec0089179efef72ac9d2473f87ca47adf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-694 Malicious code in presto-webui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc84a4fe2d659dd1d6ab8f160c0c7c4a5f1920b754c9be7cccae485027e209e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fr-config-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a3e96cb06aafc753b8adb69cabd8145c6125d89151ff1556f3685e0a99e9e84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-459 Malicious code in fr-config-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a3e96cb06aafc753b8adb69cabd8145c6125d89151ff1556f3685e0a99e9e84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-577 Malicious code in mailmason (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a4dd298cf40c979a5f0e097d16f3d9b65375a8228e45e4d2bb4ffe7b327f48e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-204 Malicious code in concord-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7557a87ec03b1b952655ca887ba93d78eb3e94a2674fbc2e2d2b86fae5272dc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-385 Malicious code in fca-chand (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7af03b2a119d8eb7ca4a3cff46b7d0cb89e8f3393071411044aec8320b19740b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-98 Malicious code in anjelo-dev2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bec068f3e56304c48c4c48eecfb4eb7fd2c133a59aee2adf16f1fef8d870e18e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...