PT-2024-32319 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.1 Description: There is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading...

MAL-2024-8925 Malicious code in basecontext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05b11d319e305490690fe36a31597a9a983ce7ea769f5123feb35cf24b6ac096 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

org.hl7.fhir.core: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r4b: org.hl7.fhir.r5: org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`

A flaw was found in HAPI FHIR - HL7 FHIR Core Artifacts. eXtensible Stylesheet Language Transformations XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...

Security Bulletin: IBM Transformation Extender Advanced v10.0.x is affected by a IBM WebSphere Application Server Liberty vulnerability

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is vulnerable to IBM WebSphere Application Server Liberty's XML External Entity XXE injection vulnerability Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

XML External Entity (XXE)

kimai/kimai is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML input, specifically failing to securely process external entities within XML documents, allowing an attacker to inject malicious XML content...

MAL-2024-8920 Malicious code in princedecmtest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4296eec1561c67a70a133ca49c6fd90770377927551f2da264742ef8d3cf3a5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8917 Malicious code in ibm-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d299d0b8d9bf7cc9c318e385566c4f1c9c972374224f38ac12d8fb90612dbdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mfp-config-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f798a6fe7590d0ef3066f87c5397720bbb22a579e8355e0893963a212454df4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8918 Malicious code in mfp-config-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f798a6fe7590d0ef3066f87c5397720bbb22a579e8355e0893963a212454df4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Gematik Referenzvalidator 代码问题漏洞

Gematik Referenzvalidator is an open source tool from gematik. It is used for advanced validation of TI applications and Contoso resources for interoperability standards. A code issue exists in Gematik Referenzvalidator that stems from the use of insecure default settings in the Woodstox...

ROS-20240918-12

A vulnerability in the Ruby REXML XML toolkit is related to uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service The XML Toolkit for Ruby REXML vulnerability is related to the presence of a DoS vulnerability in X...

PT-2024-39360 · Jflow · Jflow

Name of the Vulnerable Software and Affected Versions: JFlow version 2.0.0 Description: A problematic issue affects the function AttachmentUploadController of the component Attachment Handler, specifically in the file "/WF/Ath/EntityMutliFile Load.do". The manipulation of the argument oid leads t...

Chicheng JFLow 访问控制错误漏洞

Chicheng JFLow is a workflow engine form from China Chicheng Chicheng. An access control error vulnerability exists in Chicheng JFLow version 2.0.0, which stems from a parameter oid in file /WF/Ath/EntityMutliFileLoad.do that can lead to improper access control...

MAL-2024-8907 Malicious code in trjhasd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 503e0e46dcc93da1eb303cb9bbab8553340c3c982ec1f1f52ee4d5246afd326d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8910 Malicious code in zama1.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2afbc5173ad05196006544f59dceeb925749886b3658d14e9fe6ef4fc721c4b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

rexml: DoS vulnerability in REXML

A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file...

rexml: DoS vulnerability in REXML

A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file...

Security Bulletin: IBM Operational Decision Manager for Aug 2024 - Multiple CVEs addressed

Summary IBM Operational Decision Manager is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2023-44487...

UBUNTU-CVE-2024-46721

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix possible NULL pointer dereference profile-parent-dentsAAFSPROFDIR could be NULL only if its parent is made from createmissingancestors.. and 'ent-old' is NULL in aareplaceprofiles... In that case, it must return an...

PT-2024-10272 · Ibm · Ibm Icp - Voice Gateway

Name of the Vulnerable Software and Affected Versions: IBM ICP - Voice Gateway versions 1.0.2 through 1.0.8 Description: The issue is related to the failure to neutralize special elements used in XML, which could allow a remote attacker to send specially crafted XML statements and view or modify...