CLSA-2025-1746188001 expat: Fix of CVE-2024-8176

CVE-2024-8176: fix stack overflow vulnerability when parsing deeply nested entity references...

CLSA-2025-1746187509 expat: Fix of CVE-2024-8176

CVE-2024-8176: fix stack overflow vulnerability when parsing deeply nested entity references...

CLSA-2025-1746187414 expat: Fix of CVE-2024-8176

CVE-2024-8176: fix stack overflow vulnerability when parsing deeply nested entity references...

MAL-2025-3589 Malicious code in twewewewest6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e24697bace34244c6963d54b8439296aa2903a23b68833af4712c3506830d198 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-plugin-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56ca9dc73ad1724cba2621975411cb4f207c06e1526426ef7e257b805ac42800 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML External Entity (XXE) Injection

Overview rtc-tools is a Toolbox for control and optimization of water systems. Affected versions of this package are vulnerable to XML External Entity XXE Injection due to unsafe parsing of pathxml. An attacker could potentially exploit this by providing malicious XML input, leading to unauthoris...

Malicious code in mymte (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6027158a0ee580262d47f416e7301411cfb068dfee0c039216f1769129190e63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

Malicious code in carcandofilex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d04f8661d47623c323ee795cb954afb6a58fcaaae0b911beb0f6752004996496 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3515 Malicious code in @baywa-re-lusy/nsemea-customer-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04cade6fe87118ba0ff073c78b84a484c6d2ec20889cf67ea74c255058b7d6e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nsemea-sample-parenttransaction-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a41c3f9782e1fb062bef2307e7300491d25460f761f7e9da305bc92e541c850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3532 Malicious code in nsemea-core-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dad870b6719a7ca56397739f03731e2e597c7008601ef058d93c6b312f6b4725 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3540 Malicious code in webview-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 350de9d57836c502b1910805b2b6d9a4e1f5aad34e121671d5482c073889894a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in metadata-collector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d0c00e28320e5a836d89bb26152ff2b5c4989287285bb5071872ad3413821cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Atlassian Jira 9.12.x < 9.12.22 XML External Entity

According to its self-reported version number, the Atlassian Jira application running on the remote host is 9.12.x prior to 9.12.22. It is, therefore, affected by an XML External Entity XXE vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the...

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

CVE-2025-34490 GFI MailEssentials < 21.8 XXE Arbitrary File Read

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

CVE-2025-34490

GFI MailEssentials

Malicious code in graphhopper-js-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 528454d3ceaec479832ef3607c05e7f1a1f58026c1a94fcfb2b3835b952d9c2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...