CVE-2023-49110

CVE-2023-49110 describes an XML External Entity (XXE) injection in Kiuwan SAST when the Kiuwan Local Analyzer uploads scan results. The issue arises during server-side processing of XML files in a ZIP payload, where external XML entities are resolved. A privileged attacker who can scan source cod...

CVE-2023-49110 XML External Entity Injection in Kiuwan SAST

When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application either on-premises or cloud/SaaS solution, the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side processing of these XML...

U.S. Dept Of Defense: XML E██████ternal Entity (XXE) Injection in ███

The vulnerability described in CVE-2022-2414 was an XML External Entity XXE injection flaw. XXE vulnerabilities occur when an application improperly processes XML input containing references to external entities. This allowed access to arbitrary files on the server...

Malicious code in imageg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df52076c4f31a1cfa37f150398316cecaf3fa4608747f701714ca329d155e6b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13494704f154bacb5f2fc638287da1fe39acad551f086f8b5957f633ab310553 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1658 Malicious code in nt4padyp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 813b8cef8cb7a828bbbf2b8edb29b1bbba72c65e7654fe80f07a80398a9e5133 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nodem0m (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae93a7345bbc51bd2c0a267dc582cf90302284606b0f569ae06f4dc6a26f801a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1657 Malicious code in nodem0m (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae93a7345bbc51bd2c0a267dc582cf90302284606b0f569ae06f4dc6a26f801a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1644 Malicious code in pwi-cfa-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d39aaa33ecd66d4aac0437e45aa6a1cddcc74bb7ed416f6b33c3a7151cbc035 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rb-fare-breakup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25a5d54730dc9f0fde2c00fc22012602258fa2002141d77e8c09f61347a82e33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in logo-stylee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d393decd83d9e9777b1412a8994e72ccb1fdccc3a8157a431f4e72fe8553e717 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1639 Malicious code in stylee-logo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b57b986ab11403a14ac18370067dd40fc0a3deca0e7580b55605078ea441e720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM DevOps Release addresses multiple vulnerabilities.

Summary IBM DevOps Release 7.0.0.2 addresses multiple vulnerabilities. Vulnerability Details CVEID:CVE-2014-3643 DESCRIPTION: Jersey could allow a remote attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data by jersey SAX parser. By sending ...

MAL-2024-1622 Malicious code in @corraldev/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ce1f827fc48514e74b4bd81dc008359f2284ff02be068cbae81851f6e2056ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-MAGENTO-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that...

Multiple vulnerabilities in Toshiba Tec and Oki Electric Industry MFPs

Overview MFPs multifunction printers provided by Toshiba Tec Corporation and Oki Electric Industry Co., Ltd. contain multiple vulnerabilities listed below. Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' CWE-776 - CVE-2024-27141, CVE-2024-27142 Execution with...

XML External Entity (XXE) Injection

magento/community-edition is vulnerabile to XML External Entity XXE Injection. The vulnerability is due to improper handling of XML documents which allows for external entities to be referenced, leading to potential arbitrary code execution. An attacker can exploit this by sending a crafted XML...

PT-2024-21672 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue concerns a time-based blind XML External Entity XXE vulnerability in the XML parsing library used by the API endpoint of Toshiba printers. This vulnerability can be...

PT-2024-21673 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue concerns a time-based blind XML External Entity XXE vulnerability in the XML parsing library used by the API endpoint of Toshiba printers. This vulnerability can be...

Adobe Commerce XML External Entity Injection Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce suffers from an XML external entity injection vulnerability that can be exploited by an attacker to cause arbitrary code execution...