226 matches found
CVE-2022-27193
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...
Xxe
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...
CVE-2022-27193
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...
CVE-2022-27193
The CVRF-CSAF-Converter (Python tool) is vulnerable to XML External Entities (XXE) in versions before 1.0.0-rc2, allowing an attacker to disclose arbitrary local files from the system running the converter. The issue arises from XXE handling in the input processing. Remediation: upgrade to 1.0.0-...
CVE-2022-27193
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...
PT-2022-18280
Name of the Vulnerable Software and Affected Versions CVRF-CSAF-Converter versions prior to 1.0.0-rc2 Description The issue allows for the inclusion of arbitrary local file content into the generated output document due to XML External Entities XXE. This can be exploited by an attacker to disclos...
CVE-2022-27193: Improper Restriction of XML External Entity Reference
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...
Continuing to Listen: Good News about the Security Update Guide API!
Based on user feedback we have simplified programmatic access to the security update data by removing the authentication and API-Key requirements when using the CVRF API. You will no longer have to log in to obtain a personal API key to access the data. Were happy to make this valuable public...
Continuing to Listen: Good News about the Security Update Guide API!
Based on user feedback we have simplified programmatic access to the security update data by removing the authentication and API-Key requirements when using the CVRF API. You will no longer have to log in to obtain a personal API key to access the data. We're happy to make this valuable public...
Oracle E-Business Suite Multiple Vulnerabilities (Apr 2019 CPU)
The version of Oracle E-Business installed on the remote host is missing the April 2019 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the April 2019 Critical Patch Update advisory : - An unspecified flaw exists in the Oracle Advanced Outbound...
MySQL Enterprise Monitor 3.4.x < 3.4.8 / 4.0.x < 4.0.5 / 8.0.x < 8.0.1 Multiple Vulnerabilities (July 2018 CPU)
According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.4.x prior to 3.4.8, or 4.0.x prior to 4.0.5, or 8.0.x prior to 8.0.1. It is, therefore, affected by multiple vulnerabilities as noted in the July 2018 Critical Patch Update advisory...
Oracle VM VirtualBox < 5.2.16 Multiple Vulnerabilities (July 2018 CPU)
The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.16. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory : - An unspecified vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization...
MySQL Enterprise Monitor 3.3.x < 3.3.7.3306 / 3.4.x < 3.4.5.4248 / 4.0.x < 4.0.2.5168 Multiple Vulnerabilities (January 2018 CPU)
According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.3.x prior to 3.3.7.3306, 3.4.x prior to 3.4.5.4248, or 4.0.x prior to 4.0.2.5168. It is, therefore, affected by multiple vulnerabilities as noted in the January 2018 Critical Patch...
Oracle Critical Patch Update Advisory - January 2015
A Critical Patch Update CPU is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update...
Oracle Critical Patch Update - October 2014
A Critical Patch Update CPU is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update...
Oracle Critical Patch Update - July 2014
A Critical Patch Update CPU is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are generally cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update...
Oracle Critical Patch Update - April 2014
A Critical Patch Update CPU is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update...
Oracle Critical Patch Update - October 2013
A Critical Patch Update CPU is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update...
Oracle Critical Patch Update - July 2013
A Critical Patch Update CPU is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update...
Microsoft Adopts CVRF Format for Security Bulletins
Since the beginning of recorded time, security researchers, software vendors and hackers have been issuing security advisories in all kinds of nutty formats. Some feature excellent ASCII art, some have clever inside jokes and some come from Microsoft. Now, there’s a effort underway, called the...