Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks

Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secret...

GHSA-58CH-C2JF-5G23 Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks

Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secret...

CVE-2023-28681

Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-28682

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-28680

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-28683

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-28682

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Xxe

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Xxe

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Security Bulletin: Vulnerability from Apache Calcite affect IBM Operations Analytics - Log Analysis (CVE-2022-39135)

Summary In Apache Calcite, the SQL operators do not restrict XML External Entity references in their configuration. This makes them vulnerable to a potential XML External Entity XXE attack. Vulnerability Details CVEID:CVE-2022-39135 DESCRIPTION: Apache Calcite is vulnerable to an XML external...

Malicious code in tdv2-applet-stream-her (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61f1a3a4e828660101ffe77b0a2ddc778e1877603d971ba4e76e4f7d85692a34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-844 Malicious code in tdv2-applet-video-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da1ead0644279944ddb37ff7dda20637a0e69f7b394e09a54ab9aee33629e2d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-573 Malicious code in lupinfakepackagingforscanners (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca938918b5315749c762599827ac5c476263e5cff212e64bf8f03b65530b68f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-834 Malicious code in tdv2-applet-account-switch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55bd5fe83ef948d508a50d52dc63e8e0628ff1d433190e9730b29bc2c29d28b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-840 Malicious code in tdv2-applet-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44d9f0f475f31c69d603b6953d97d1b896179620b901a811fd032be0a22d9003 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-980 Malicious code in yahoodotcom-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb0a9ae16cfadd970962e84bc11d082b5a7354335f88909193d51c5a759a1cfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-833 Malicious code in td-service-canvas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 795a528873994ea135446c861a7fc9cb20977c13cafcb0b58ecc4f691614de90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-152 Malicious code in caas-canvas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f23fafb0314732e3d785fa0db698e59bc25c66945493df1ef85a45a115e8a270 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-836 Malicious code in tdv2-applet-monalixa.store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c1d448a144690b4cb560c6addca919072d44b799f174ae3bcc148bb25a81308 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-838 Malicious code in tdv2-applet-search-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e022c3efe7e835b45fddf0e6d3e78494e10cf44eae43cfdc147cadbe25d7dc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...