GHSA-8H9C-R582-MGGC OWSLib vulnerable to XML External Entity (XXE) Injection

Impact OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. Patches - Use only lxml for XML handling, adding...

MAL-2023-388 Malicious code in fca-dark-rulex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dc65e0b0172e4250c22303c0778367df0d04b4256634ccb454dbff9bcd8415e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-21156 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.11 XWiki Platform versions prior to 14.4.7 XWiki Platform versions prior to 14.10-rc-1 Description: The XWiki Platform is a generic wiki platform offering runtime services for applications built on top o...

OWSLib 代码问题漏洞

OWSLib is a Python package for client-side programming using the Open Geospatial Consortium OGC Web Services hence the name OWS interface standard and its associated content model. A code issue vulnerability exists in versions of OWSLib prior to 0.28.1 that stems from an XML parser that does not...

PT-2023-21153

Name of the Vulnerable Software and Affected Versions OWSLib versions prior to 0.28.1 Description The XML parser in OWSLib does not disable entity resolution, which could lead to arbitrary file reads from an attacker-controlled XML payload. This issue affects all XML parsing in the codebase. The...

CVE-2023-27480: Improper Restriction of XML External Entity Reference

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host...

CVE-2023-27476: Improper Restriction of XML External Entity Reference

OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...

CVE-2023-27472

quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised XSS vulnerability. Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag ...

CVE-2023-27472 HTML tags in entity names in the tree view are not sanitised in quickentity-editor-next

quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised XSS vulnerability. Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag ...

Experts Reveal Google Cloud Platform's Blind Spot for Data Exfiltration Attacks

Malicious actors can take advantage of "insufficient" forensic visibility into Google Cloud Platform GCP to exfiltrate sensitive data, a new research has found. "Unfortunately, GCP does not provide the level of visibility in its storage logs that is needed to allow any effective forensic...

Malicious code in owa-fabric-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00c697ee4df7db1ed759f515b005aa747d8b25e658b91a7f744d69bbf1e8a99e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in owa-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e11e49aab0abb7a01a703ccc6527f87fb4d48ccf2f542466b209e0bd4ca1b2da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-660 Malicious code in owa-fabric-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00c697ee4df7db1ed759f515b005aa747d8b25e658b91a7f744d69bbf1e8a99e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-662 Malicious code in owa-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e11e49aab0abb7a01a703ccc6527f87fb4d48ccf2f542466b209e0bd4ca1b2da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

QuickEntity Editor 跨站脚本漏洞

QuickEntity Editor is a QuickEntity Editor by atampy25 Personal Developer. A cross-site scripting vulnerability exists in QuickEntity Editor that stems from an uncleaned HTML tag in an entity name...

PT-2023-21150 · Unknown · Quickentity-Editor-Next

Name of the Vulnerable Software and Affected Versions: quickentity-editor-next versions prior to 1.28.1 Description: The issue concerns an open source, system local, video game asset editor. In affected versions, HTML tags in entity names are not sanitized, leading to an XSS vulnerability. This...

CVE-2023-27472: Improper Neutralization of Input During Web Page Generation

quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised XSS vulnerability. Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag ...

Security Bulletin: There is a security vulnerability in Apache SOAP used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2022-40705)

Summary There is a security vulnerability in Apache SOAP used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2022-40705 DESCRIPTION: Apache SOAP is vulnerable to an XML external entity injection XXE attack when processing XML data, caused by a...

CVE-2023-26046

CVE-2023-26046 affects kitabisa/teler-waf (Go HTTP middleware). Prior to v0.1.1, it fails to properly sanitize HTML entities in user input, enabling bypass of common web attack rules and enabling cross-site scripting (XSS) in a victim’s browser. Impact described across multiple sources includes a...

teler-waf contains detection rule bypass via Entities payload

Description teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab...