Security Bulletin: Maximo Application Suite - IBM WebSphere Application Server Liberty is vulnerable to CVE-2024-22354 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses WebSphere Application Server Liberty which is vulnerable to CVE-2024-22354. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere Application...

CVE-2024-6893

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources...

Malicious code in viewability-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d6ab3215e22d1ba76d15137a6915fc6703eb21620b8821706dc5b006ce735d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty - v.24.0.0.4 which is vulnerable to CVE-2024-27268 and CVE-2024-22353.

Summary IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty - v.24.0.0.4 which is vulnerable to CVE-2024-27268 and CVE-2024-22353. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-22353 DESCRIPTION: IBM...

Malicious code in diosaziose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e55eab0b1fe3321b359ded42ffc43ae4db39f3ff2dab487f6843d966631c5f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-3930

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity XXE was discovered...

CVE-2024-3930

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity XXE was discovered...

CVE-2024-3930 XML External Entity in Akana

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity XXE was discovered...

CVE-2024-3930 XML External Entity in Akana

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity XXE was discovered...

CVE-2024-3930

CVE-2024-3930 is an XML External Entity (XXE) vulnerability in Akana API Platform prior to 2024.1.0. The NVD entry cites CVSS v3.1: Base score 9.8 (CRITICAL) with network attack vector, no privileges or user interaction required, and impacts to confidentiality, integrity, and availability. Other ...

Akana API Platform 代码问题漏洞

Akana API Platform is one of Akana's easiest ways to accelerate digital transformation in your organization. A code issue vulnerability exists in Akana API Platform versions prior to 2024.1.0 that stems from the presence of XML External Entity XXE injection...

CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)

This combination of an Arbitrary File Read CVE-2024-34102 and a Buffer Overflow in glibc CVE-2024-2961 allows for unauthenticated Remote Code Execution on the following versions of Magento and Adobe Commerce and earlier if the PHP and glibc versions are also vulnerable: - 2.4.7 and earlier -...

XML External Entity (XXE) Injection

Apache Drill is vulnerable to XML External Entity XXE Injection. The vulnerability is due to inadequate restriction of external entity references, allowing attackers to access files or execute commands through manipulated XML data...

VulnCheck KEV: CVE-2019-15637

Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop...

GHSA-V62G-JWJ9-RFVX XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue...

Apache Drill 代码问题漏洞

Apache Drill is an open source software framework from the American company Apache Apache. Apache Drill 1.19.0 and earlier versions suffer from an XML external entity injection vulnerability that can be exploited by an attacker to read any file on a remote file system or execute commands through ...

CVE-2024-40075

Laravel v11.x was discovered to contain an XML External Entity XXE vulnerability...

CVE-2024-40075

Laravel v11.x was discovered to contain an XML External Entity XXE vulnerability...

PT-2024-28770 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel versions 11.x Description: The issue is related to an XML External Entity XXE vulnerability. This means that the software may be susceptible to attacks that manipulate XML entities to access unauthorized data or execute system-level...

CVE-2024-40075

Laravel v11.x was discovered to contain an XML External Entity XXE vulnerability...