31722 matches found
CVE-2023-20903
This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh token is issued to a client on behalf of a user from that identity provider, the administrator of the UAA deactivates t...
Malicious code in credit-risk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd701c8e3663f6d6d51ecbf7c2455cdc266d2ea4b6d25f3b52a6efbddf402eb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in mbm-dgacha (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 584950211093c6cada6fd340d94a5749b3ee5e10049a6d57b9d3f1c494050fa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in accumulate-win (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7d58450a0e39a1b76cf94a28abe87bc0d2378707501c80df577818faa471d52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in react-xterm2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5f7c63ca98cf3df8c6642ac2a87eb6834e09162e30cd05b50172c8fa4f5cd32 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in codeword (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2aaf95d3c6934f346d9582d701dca64e259a66b0f2e42ed55c8c2b7096bf7af0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in com.unity.live-capture (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3664ab2388f69675052d3fa71e2047676393cdd75a8fa57ca2d1ca11b1b10891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in com.unity.netcode.gameobjects (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 131cc29f9c925613b77fd6e6c06f43433bdc5a9511461af56fd519562408c3c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
CVE-2022-43473
A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability...
CVE-2022-43430
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
CVE-2022-34350
IBM API Connect 10.0.0.0 through 10.0.5.0, 10.0.1.0 through 10.0.1.7, and 2018.4.1.0 through 2018.4.1.20 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to...
CVE-2022-34474
Even when an iframe was sandboxed with allow-top-navigation-by-user-activation, if it received a redirect header to an external protocol the browser would process the redirect and prompt the user as appropriate. This vulnerability affects Firefox 102...
CVE-2022-3832
The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-3340
XML External Entity XXE vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved XML configuration file to be imported...
CVE-2022-29943
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity XXE processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201...
CVE-2022-41713
deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the 'proto' property to be edited...
CVE-2022-45588
All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity XXE type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 and Talend Cloud Engine for Design are no...
CVE-2022-2330
Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent...