MAL-2024-11995 Malicious code in internallib_v420 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 291a2b6b3559f93316c3fa8d0ab9ddf6a6417051190512d339da5b8c5e5827cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gps-gateway-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7841067a161c55356141a3d1e9fb8bd1922ff25291edeb0d46e708a9e6b563b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-config-extraterm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ac174483503687af78d8c768a2f9fa3abad4e982d193634c81b8870484ae360 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nimiq-rewards-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d950995f06dd02bfab4e652ede8b9806d3cdd50d46d63c8f03da915e20a25da2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nerd4node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9212e7685c7fd13159cdd6b31f5c0b398be7266d6fcbab454def7f7d8fa1a781 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2024-46455

unstructured v.0.14.2 and before is vulnerable to XML External Entity XXE via the XMLParser...

The vulnerability of the Ucum library in the Java programming language, which allows attackers to perform XXE attacks

The vulnerability of the Ucum library for the Java programming language is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

CVE-2024-55081

CVE-2024-55081 describes an XML External Entity (XXE) injection in the Chat2DB 0.3.5 component /datagrip/upload that can lead to arbitrary code execution when a crafted XML input is supplied. Affected software: Chat2DB v0.3.5; vulnerable part: /datagrip/upload; root cause: XXE vulnerability. Impa...

Chat2DB 安全漏洞

Chat2DB is an AI-driven SQL client open-sourced by CodePhiliaX. A security vulnerability exists in Chat2DB version v0.3.5, which stems from the presence of XML external entity injection in the component /datagrip/upload, allowing an attacker to execute arbitrary code by providing crafted XML inpu...

CVE-2024-55081

An XML External Entity XXE injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input...

OpenText Operations Bridge Manager 安全漏洞

OpenText Operations Bridge Manager is an enterprise activity and performance management software from OpenText Canada. A security vulnerability exists in OpenText Operations Bridge Manager that stems from an improper restriction of the XML External Entity References vulnerability, which allows...

CLSA-2024-1734535703 php: Fix of CVE-2023-3823

CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing...

XML External Entity

org.http4k, http4k-format-xml is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper handling of malicious XML content in requests, which could allow attackers to access sensitive local information, perform Server-side Request Forgery SSRF, or potentially execute...

PT-2024-9971 · Opentext · Opentext Operations Bridge Manager

Name of the Vulnerable Software and Affected Versions: OpenText Operations Bridge Manager versions 2017.05 through 2020.10 Description: The issue is related to an Improper Restriction of XML External Entity Reference, which could allow for Input Data Manipulation. This could be exploited to gain...

MAL-2024-11901 Malicious code in dex12212 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd70efd3b822fddc9faef296a7834c2a084ca44589d334e1dcb3b464cd9eb9de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SAP NetWeaver AS Java Multiple Vulnerabilities (December 2024)

SAP NetWeaver Application Server for Java is affected by multiple vulnerabilities, including the following: - Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind...

PT-2024-41104 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: Libdwg affected versions not specified Description: The software contains an index-out-of-bounds issue discovered by OSS-Fuzz. The crash occurs within the dwg decode eed, dwg decode entity, and dwg decode RAY private functions. Recommendation...

GHSA-W9J7-PHM3-F97J Ucum-java has an XXE vulnerability in XML parsing

Impact XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can...

CVE-2024-55887

A flaw was found in the ucum-java library for FHIR. XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being use...

CVE-2024-55887

Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts...