GHSA-GCHV-364H-R896 XML External Entity Reference in apache jena

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 only. Apache Jena 4.2.x and 4.3.x do not allow external entities...

DEBIAN-CVE-2022-28890

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities...

GHSA-JMHH-W7XP-WG39 Nokogiri vulnerable to DoS while parsing XML entities

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits...

Nokogiri vulnerable to DoS while parsing XML entities

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits...

Talend Administration Center 代码问题漏洞

Talend Administration Center is a web-based application from Talend that centralizes studio management. A security vulnerability exists in Talend Administration Center. An attacker exploits the vulnerability to use XML External Entities XXE to achieve root read access on a remote file system...

Quick Node Clone - Moderately critical - Access bypass - SA-CONTRIB-2022-038

The module adds a "Clone" tab to a node. When clicked, a new node is created and fields from the previous node are populated into the new fields. This module supports paragraphs, groups, and other referenced entities. The module has a vulnerability which allows attackers to bypass the protection ...

CVE-2022-1331

In four instances DMARS All versions prior to v2.1.10.24 does not properly restrict references of XML external entities while processing specific project files, which may allow unauthorized information disclosure...

Information disclosure

In four instances DMARS All versions prior to v2.1.10.24 does not properly restrict references of XML external entities while processing specific project files, which may allow unauthorized information disclosure...

CVE-2022-1331

CVE-2022-1331 affects Delta Electronics DMARS (all versions prior to v2.1.10.24). The issue is improper restriction of XML External Entity references when processing project/DMARS files, leading to potential unauthorized information disclosure. Multiple sources (NVD entry, CVE CVE-2022-1331 recor...

Apache NiFi 代码问题漏洞

Apache NiFi is a data processing and distribution system from the Apache Foundation in the United States. The system is primarily used for data routing, transformation, and system brokerage logic.A security vulnerability in Apache NiFi versions 0.0.1 through 1.16.0 stems from multiple components...

XWiki Commons代码问题漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from a script that can access any file service accessed by a user running an XWiki application server via XML script injection via XML external entities...

Chinese Hackers Targeting Russian Military Personnel with Updated PlugX Malware

A China-linked government-sponsored threat actor observed striking European diplomatic entities in March may have been targeting Russian government officials with an updated version of a remote access trojan called PlugX. Secureworks attributed the attempted intrusions to a threat actor it tracks...

The vulnerability of the `php_html_entities` function in the PHP programming language allows attackers to trigger a service failure or potentially cause other adverse effects.

The vulnerability of the phphtmlentities function in the PHP programming language is caused by a numerical overflow condition. Exploiting this vulnerability can allow an attacker to cause service failures or potentially other adverse effects...

The vulnerability of the php_escape_html_entities_ex function (ext/standard/html.c) in the PHP language interpreter allows a attacker to trigger a service failure or possibly cause other effects.

The vulnerability of the phpescapehtmlentitiesex function ext/standard/html.c in the PHP language interpreter is caused by a numerical overflow condition. Exploiting this vulnerability could allow an attacker to cause service failures or potentially cause other adverse effects...

The US Cyber Incident Reporting Act – its impact and its requirements for Critical Infrastructure Entities

...

FBI Releases IOCs Associated with BlackCat/ALPHV Ransomware

The Federal Bureau of Investigation FBI has released a Flash report detailing indicators of compromise IOCs associated with attacks involving BlackCat/ALPHV, a Ransomware-as-a-Service that has compromised at least 60 entities worldwide. CISA encourages users and administrators to review the IOCs...

OpenAPI Missing MIME Types

OpenAPI specification is an API description format for REST APIs. An OpenAPI file is written in YAML or JSON and describes all the API properties like the available endpoints with the related operations or the authentication methods. The consumes field defines the expected data types for POST, PU...

libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c

There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability...

CVE-2020-13590

Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities, this can be done...

Delta Electronics DMARS 代码问题漏洞

Delta Electronics DMARS is an Industrial Automation/Embedded Motion Controller from Delta Electronics Taiwan, China. A code issue vulnerability exists in Delta Electronics DMARS that stems from affected products not properly restricting references to XML external entities when processing specific...