CVE-2024-56883

CVE-2024-56883 affects Sage DPW prior to 2024_12_001. The issue is improper server-side access control: RBAC is not consistently enforced, allowing low-privilege employee-role users to create external courses for others by tampering the id parameter in a create request. Impact is elevated access ...

CVE-2024-25066

RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity XXE attacks via a license file, resulting in attacker-controlled files being stored on the product's server. Data exfiltration cannot occur...

BIT-GITLAB-2024-9870 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab

An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services...

Malicious code in bithumb-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 486276686eda2f4f675b363605d7e934f7665dfbca8a85f49d8b76a801f7ce43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in weex-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b584007c16319ecc4cbb0dadad514e12e33872b44707c476ea044b163bfc335e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in orangex-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72138d591e4116ce9a82ea1b145e24a0dd98ffb5ae09004a2b9b447b87afb2c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in p2pb2b-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a0473d0f0125406881ecf6afe601b962e4ebfb4dd7aee64effa8444f4a84be1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1400 Malicious code in coinstore-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58dfe66499691e4a2a71a5bd5f3660d8db97c4fbf7f662f3e24b4c0ed0cff3a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1438 Malicious code in tbasdzqdl55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 839e4e7903c73d714b549caf9b44abb2b9e1167d17f45929dee4cdd4e28f17eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-25066

RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity XXE attacks via a license file, resulting in attacker-controlled files being stored on the product's server. Data exfiltration cannot occur...

CVE-2024-25066

CVE-2024-25066 affects RSA Authentication Manager prior to 8.7 SP2 Patch 1. It enables XML External Entity (XXE) attacks via a license file, allowing attacker-controlled files to be stored on the server. Data exfiltration is not possible. Remediation: upgrade to 8.7 SP2 Patch 1 or later; as a tem...

PT-2025-6627 · Rsa · Emc Rsa Authentication Manager

Name of the Vulnerable Software and Affected Versions: RSA Authentication Manager versions prior to 8.7 SP2 Patch 1 Description: The issue allows XML External Entity XXE attacks via a license file, resulting in attacker-controlled files being stored on the product's server. Data exfiltration cann...

CVE-2024-25066

RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity XXE attacks via a license file, resulting in attacker-controlled files being stored on the product's server. Data exfiltration cannot occur...

RSA Authentication Manager 安全漏洞

RSA Authentication Manager is a secure access and authentication platform from RSA Corporation. A security vulnerability exists in RSA Authentication Manager versions prior to 8.7 SP2 Patch 1, which stems from an XML external entity attack that can be performed via a license file, resulting in an...

CVE-2024-9870

An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services...

CVE-2023-50380

XML External Entity injection in apache ambari versions = 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The...

SUSE CVE-2023-3823

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling...

SUSE CVE-2023-45725

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: list show rewrite update An attacker can leak the session component using an HTML-like output, insert t...

The vulnerabilities of the Generic Data Mapper, Engineering Adapter, and Engineering Interface modules of the software for designing, operating, and maintaining technological installations like COMOS, allow attackers to execute XXE attacks.

The vulnerability of the Generic Data Mapper, Engineering Adapter, and Engineering Interface modules of the COMOS software for designing, operating, and maintaining technological installations is related to a bug that restricts XML references to external objects. Exploiting this vulnerability cou...

Malicious code in pages-e2e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8fdc9ed5e9c2f9d6d0e57ed2a060d76ead69858fcbae60c4265500ef4dd1527 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...