CVE-2024-39586

Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially exploit this vulnerability, leading to information disclosure...

MAL-2024-9127 Malicious code in b3rnt7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4f36c23002f7cc6c40ed39eee45af8aa13ed343fa9d96ffb4aff7581eb014ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in makebetteremail (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c05ae267bfe19d2a54f813347f8df26dc550dbe7da0b20207863fd732bcd55d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2024-2591)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache XML Graphics FOP 代码问题漏洞

Apache XML Graphics FOP is a Java application for converting XSL-FO files to PDF or other printable formats from the Apache Foundation USA. A code issue vulnerability exists in Apache XML Graphics FOP version 2.9, which stems from the presence of an incorrectly restricted XML external entity...

Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2024-2514)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2024-2565)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Dell AppSync Server 代码问题漏洞

Dell AppSync Server is a copy data management software from Dell USA. An XML external entity injection vulnerability exists in Dell AppSync Server versions 4.3 through 4.6, which arises from a networked system or product that does not have the correct filters in place to allow references to...

EulerOS 2.0 SP11 : python-lxml (EulerOS-SA-2024-2591)

According to the versions of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function of lxml before v4.9.1 allows attackers to access sensitive...

PT-2024-28543 · Dell · Dell Appsync Server

Name of the Vulnerable Software and Affected Versions: Dell AppSync Server versions 4.3 through 4.6 Description: The issue is related to an XML External Entity Injection, which could be exploited by an adjacent high privileged attacker, potentially leading to information disclosure...

CVE-2024-45293 XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel XLS...

XML External Entity (XXE) Injection

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to XML External Entity XXE Injection through the toUtf8 function in the XmlScanner.php file. An attacker can disclose server files...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection through the toUtf8 function in the XmlScanner.php file. An attacker can disclose server files and sensitive information by providing an Excel sheet with a modified XML structure, specifying UTF-7 encodi...

Security Bulletin: IBM Security Verify Governance has multiple vulnerabilities

Summary Multiple security vulnerabilities have been addressed in an update for IBM Security Verify Governance. Vulnerability Details CVEID:CVE-2024-30172 DESCRIPTION: The Bouncy Castle Crypto Package For Java is vulnerable to a denial of service, caused by an infinite loop in the Ed25519...

CVE-2024-45745

TopQuadrant TopBraid EDG before version 8.0.1 allows an authenticated attacker to upload an XML DTD file and execute JavaScript to read local files or access URLs XXE. Fixed in 8.0.1 bug fix: TBS-6721...

PT-2024-31744

Name of the Vulnerable Software and Affected Versions: TopQuadrant TopBraid EDG versions prior to 8.0.1 Description: The issue allows an authenticated attacker to upload an XML DTD file and execute JavaScript, enabling them to read local files or access URLs, which is an example of an XML Externa...

DataEase XML External Entity Injection Vulnerability

DataEase is a lightweight, high-performance self-service data visualization and analysis tool that helps users quickly explore and understand complex data, provides real-time data analysis and report generation capabilities, supports a variety of data sources, and is designed to improve data...

GHSA-4M9P-7XG6-F4MM DataEase has an XML External Entity Reference vulnerability

Impact There is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. 1. send request: POST /de2api/staticResource/upload/1 HTTP/1.1 Host: dataease.ubuntu20.vm...

DataEase has an XML External Entity Reference vulnerability

Impact There is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. 1. send request: POST /de2api/staticResource/upload/1 HTTP/1.1 Host: dataease.ubuntu20.vm...

CVE-2024-46985 DataEase has an XXE vulnerability

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...