BIT-PHP-MIN-2023-3823 Security issue with external entity loading in XML without enabling it

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling...

CVE-2024-12298

We found a vulnerability Improper Restriction of XML External Entity Reference CWE-611 in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer...

CVE-2024-12298

The CVE-2024-12298 issue is an XXE vulnerability (CWE-611) in Omron NB-series NX-Designer / NB-Designer. The root cause is improper restriction of XML external entity references, enabling disclosure of confidential data on the host when a specially crafted file is opened. Affected software includ...

CVE-2024-12298 Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer

We found a vulnerability Improper Restriction of XML External Entity Reference CWE-611 in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer...

CVE-2024-12298 Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer

We found a vulnerability Improper Restriction of XML External Entity Reference CWE-611 in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer...

The vulnerability of the Entity Form Steps module in the Drupal CMS system, related to the lack of protective measures for website structures, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Entity Form Steps module in the Drupal CMS system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

PT-2025-1806 · Unknown · Nb-Series Nx-Designer

Name of the Vulnerable Software and Affected Versions: NB-series NX-Designer affected versions not specified Description: The issue is related to an Improper Restriction of XML External Entity Reference, which may allow attackers to disclose confidential data on a computer. This could potentially...

The vulnerability of the Drupal File Entity CMS system, related to the lack of measures taken to protect the website structure, allows attackers to bypass security restrictions and perform cross-site scripting attacks.

The vulnerability of the Drupal File Entity CMS system is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and perform cross-site scripting attacks...

Malicious code in zqdl5551 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbd5f002e9be6ed643e4f041658ca89255b5c1a056c671f58ff4d1ef4257e908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Omron NB-Designer 代码问题漏洞

Omron NB-Designer is a programmable terminal software from Omron Corporation Japan. A code issue vulnerability exists in Omron NB-Designer V.1.63 and earlier versions, which stems from an improperly restricted XML external entity reference vulnerability that could be exploited by an attacker to...

DEBIAN-CVE-2024-49573

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...

UBUNTU-CVE-2024-49573

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...

CVE-2024-49573 sched/fair: Fix NEXT_BUDDY

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...

CVE-2024-49573

CVE-2024-49573 relates to the Linux kernel scheduler (sched/fair.c). The fix patches NEXT_BUDDY handling in pick_next_entity() by moving clear_buddies() before the delayed dequeue logic and ensuring no new next buddy starts as delayed. This addresses a WARN triggered by enabling NEXT_BUDDY, with ...

Security Bulletin: Due to use of IBM WebSphere Application Server, IBM Workload Automation is vulnerable to a server-side forgery attack,

Summary IBM WebSphere Application Server is used by IBM Workload Automation CVE-2024-22354 Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External...

CVE-2024-13305

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...

CVE-2024-13305

The CVE-2024-13305 entry concerns the Drupal Entity Form Steps module, with the affected range: 0.0.0 through 1.1.3. The root cause is improper neutralization of input during web page generation, enabling Cross-Site Scripting (XSS). The vulnerability is tied to the Entity Form Steps functionality...

CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...

CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...

CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...