CVE-2023-38693 RCE in Lucee REST endpoint

Lucee Server or simply Lucee is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173...

CVE-2025-24521 Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference

External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25...

CVE-2025-24521 Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference

External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25...

CVE-2025-24521

The CVE-2025-24521 entry concerns Keysight Ixia Vision Product Family with an External XML Entity (XXE) injection vulnerability. This flaw allows an attacker to trigger arbitrary file downloads, as described in multiple sources, and is noted to potentially enable further device compromise when co...

Malicious code in franklin-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3ae87b2a01452220350394a2c4d2671059d9016de72c9ad7692fe35628357c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in swerve-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6b1194d6641e2147013bfade0bd7f7e18dec7eb509797c7d004c43e2886e02d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alexpavlov--jquery-suggestable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f4773aee85f3d282a89ee413b5af4e93365981f67b821882709daf1d3cc6eac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2169 Malicious code in edx-monitoring-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d47b1fbec9c47eee15eb0547c1da8cc774108bd7cd6ae38a51cbe4dbfbe74941 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Linux Distros Unpatched Vulnerability : CVE-2024-3572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper...

Linux Distros Unpatched Vulnerability : CVE-2022-48565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid X...

Linux Distros Unpatched Vulnerability : CVE-2020-25649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity X...

Linux Distros Unpatched Vulnerability : CVE-2023-45139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an...

Linux Distros Unpatched Vulnerability : CVE-2021-39371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An XML external entity XXE injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the...

Lucee 代码问题漏洞

Lucee is a high-performance open source CFML server written in Java by Lucee Open Source. A code issue vulnerability exists in Lucee versions 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173, which stems from an XML External Entity References attack and could lead to remote code execution...

Keysight Ixia Vision 代码问题漏洞

Keysight Ixia Vision is a family of network packet agents from Keysight, Inc. A code issue vulnerability exists in Keysight Ixia Vision Product Family version 6.3.1, which stems from an external XML entity injection could lead to arbitrary file downloads...

Linux Distros Unpatched Vulnerability : CVE-2022-2414

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve t...

Malicious code in my-custom-vue-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45c516cbd7bda6255ce1f5a2b53f65970a24bb84aa4fc373041f73a440b8ae41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nnnn1111222 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b648679c0195621d738427824e86329b24252cdb88b8488f0528db1938965b05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in com.github-glitchenzo.nugetforunit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2641b4718102c38479e074fc167269436aadb2ff01a5b703a1c5e0a02fa09d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2126 Malicious code in saml-sp-linking-sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cefc3296ba659b91b026973376ed7a792b2c6c13d304e42d3742eddd7ae5ed0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...