PT-2023-11756 · Pyxml · Pyxml

Name of the Vulnerable Software and Affected Versions: py-xml version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted XML file, exploiting an XML External Entity Injection XXE vulnerability. Recommendations: For py-xml version 1.0, consider disabling the XML...

py-xml 代码问题漏洞

py-xml is a Python XML binding library open source by China Pinae. A security vulnerability exists in py-xml v1.0, which stems from the inclusion of an XML External Entity Injection XXE vulnerability that allows an attacker to execute arbitrary code through a crafted XML file...

CVE-2020-26709: Improper Restriction of XML External Entity Reference

py-xml v1.0 was discovered to contain an XML External Entity Injection XXE vulnerability which allows attackers to execute arbitrary code via a crafted XML file...

CVE-2020-26709

py-xml v1.0 was discovered to contain an XML External Entity Injection XXE vulnerability which allows attackers to execute arbitrary code via a crafted XML file...

CVE-2020-26709

CVE-2020-26709 affects py-xml v1.0 and is caused by an XML External Entity (XXE) vulnerability in the XML parsing path, allowing an attacker to execute arbitrary code via a crafted XML file. The issue is documented across multiple sources (NVD entry, Red Hat advisory, GHSA, OSV, CNNVD, CVE list, ...

Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary IBM has addressed multiple vulnerabilities in IBM Spectrum Discover. Webpack loader-utils CVE-2022-37601 is vulnerable to execute arbitrary code on the system caused by a pollution flaw in parseQuery function. OpenStack Keystone CVE-2021-3563 is vulnerable to bypass security restriction...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

Malicious code in pylint-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3445cee4e2fd4e4e0170f04b51b2a3409af7c1b2478609a38bcc46d5094e134d The OpenSSF Package Analysis project identified 'pylint-py' @ 15.0.3 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1394 Malicious code in pylint-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3445cee4e2fd4e4e0170f04b51b2a3409af7c1b2478609a38bcc46d5094e134d The OpenSSF Package Analysis project identified 'pylint-py' @ 15.0.3 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-10 Malicious code in security-util-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2309de1524c064d7eba8b0c288762426955241d23e00eaaeca7766758ab9054e The OpenSSF Package Analysis project identified 'security-util-py' @ 0.0.6 pypi as malicious. It is considered malicious because: - The package...

Malicious code in py-intellibint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c51243b24c705c8e86f895cf56a4aaf31db49b64674882dbef77513f1bc075dc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5233 Malicious code in py-intellibint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c51243b24c705c8e86f895cf56a4aaf31db49b64674882dbef77513f1bc075dc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

FreeBSD : py-cinder -- unauthorized data access (a0509648-65ce-4a1b-855e-520a75bd2549)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a0509648-65ce-4a1b-855e-520a75bd2549 advisory. - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance...

FreeBSD : py-cryptography -- includes a vulnerable copy of OpenSSL (c1a8ed1c-2814-4260-82aa-9e37c83aac93)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c1a8ed1c-2814-4260-82aa-9e37c83aac93 advisory. - There is a type confusion vulnerability relating to X.400 address processing inside an X.509...

FreeBSD : py-cryptography -- allows programmers to misuse an API (a32ef450-9781-414b-a944-39f2f61677f2)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a32ef450-9781-414b-a944-39f2f61677f2 advisory. - cryptography is a package designed to expose cryptographic primitives and recipes to Python developer...

FreeBSD : py-suds -- vulnerable to symlink attacks (b31f7029-817c-4c1f-b7d3-252de5283393)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b31f7029-817c-4c1f-b7d3-252de5283393 advisory. - cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and...

FreeBSD : py39-redis -- can send response data to the client of an unrelated request (3f6d6181-79b2-4d33-bb1e-5d3f9df0c1d1)

"The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3f6d6181-79b2-4d33-bb1e-5d3f9df0c1d1 advisory. - redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an...

FreeBSD : py-slixmpp -- incomplete SSL certificate validation (93db4f92-9997-4f4f-8614-3963d9e2b0ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 93db4f92-9997-4f4f-8614-3963d9e2b0ec advisory. - Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to...

FreeBSD : py39-py -- Regular expression Denial of Service vulnerability (28a37df6-ba1a-4eed-bb64-623fc8e8dfd0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 28a37df6-ba1a-4eed-bb64-623fc8e8dfd0 advisory. - The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expressio...

FreeBSD : py-ansible -- multiple vulnerabilities (e1b77733-a982-442e-8796-a200571bfcf2)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e1b77733-a982-442e-8796-a200571bfcf2 advisory. - A flaw was found in Ansible Base when using the awsssm connection plugin as garbage collecto...