XML External Entity (XXE) Injection

typo3/cms is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper handling of XML input, which allows attackers to load internal or external files within an XML structure and potentially inject arbitrary files to cause a denial of service or other attacks...

PT-2024-13223 · Ibm · Ibm Engineering Requirements Management Doors Next

Name of the Vulnerable Software and Affected Versions: IBM Engineering Requirements Management DOORS Next versions 7.0.2 through 7.0.3 Description: The issue is related to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitiv...

IBM Engineering Requirements Management DOORS Next Code Issue Vulnerability

IBM Engineering Requirements Management DOORS Next is a scalable solution from International Business Machines IBM. The solution helps you capture, track, analyze, and manage systems and advanced IT application development. A code issue vulnerability exists in IBM Engineering Requirements...

SEW-EURODRIVE MOVITOOLS MotionStudio XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote atttackers to disclose sensitive information on affected installations of SEW-EURODRIVE MOVITOOLS MotionStudio. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

GHSA-2P4F-VC9Q-R5VP Typo3 Arbitrary file upload and XML External Entity processing

It has been discovered that Flow 3.0.0 allows arbitrary file uploads, inlcuding server-side scripts, posing the risk of attacks. If those scripts are executed by the server when accessed through their public URL, anything not blocked through other means is possible information disclosure, placeme...

Typo3 Arbitrary file upload and XML External Entity processing

It has been discovered that Flow 3.0.0 allows arbitrary file uploads, inlcuding server-side scripts, posing the risk of attacks. If those scripts are executed by the server when accessed through their public URL, anything not blocked through other means is possible information disclosure, placeme...

GHSA-VH6J-WV25-8QXR Flow Bugfix Releases for Entity Security

If you had used entity security and wanted to secure entities not just based on the user's role, but on some property of the user like the company he belongs to, entity security did not work properly together with the doctrine query cache. This could lead to other users re-using SQL queries from...

Flow Bugfix Releases for Entity Security

If you had used entity security and wanted to secure entities not just based on the user's role, but on some property of the user like the company he belongs to, entity security did not work properly together with the doctrine query cache. This could lead to other users re-using SQL queries from...

Security Bulletin: IBM Engineering Requirements Management DOORS Next is vulnerable to XML External Entity Injection (XEE) (CVE-2023-45192)

Summary IBM Engineering Requirements Management DOORS Next is vulnerable to CVE-2023-45192 potential XML External Entity Injection XEE attacks. Vulnerability Details CVEID:CVE-2023-45192 DESCRIPTION: IBM Engineering Requirements Management DOORS Next is vulnerable to an XML External Entity...

MAL-2024-1533 Malicious code in glup-debugger-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5001b44290fb031aa2d19602d8706fe384823c3fd0a2a02dedb3bab957d93f07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1527 Malicious code in win66lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef7e6b9c91af7d4a4e2199453260e026047e3029e2d8cc795fd530f1e6e1e8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1528 Malicious code in winextracter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec386ca312f4527fe9f4260bf50d54dbc2abd05df6fd2784420e95e52cff8baf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1519 Malicious code in npmnewtest-avisheknayal122 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd48b8c1125a76b62b374d6e9b51b8a992a9ecd8248f793c7ead6428ecb96080 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in demo-sridhar.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76211b004075aee6d23e4dbc2b6e2bf8e413a93072dfe370de9c19dcef6e845d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1510 Malicious code in demotestsample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81deaf8942b0c1f252d8e518570899524ba93df16ac9a9d325cb4a0dbafcf4f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1507 Malicious code in dematestsample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fa4c0092d2fc8675c490b33d703becf8a79965b1d0623cea62a0581dc4015e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1508 Malicious code in demo-sridhar.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76211b004075aee6d23e4dbc2b6e2bf8e413a93072dfe370de9c19dcef6e845d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1501 Malicious code in @juiggitea/voluptatem-quos-blanditiis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3ffad47dd5e4b83c52c28d23cac90196cb72fb455eb2a08e1fdbad8dc177657 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1500 Malicious code in @juiggitea/vero-placeat-ea-consequuntur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce8c3feba471a4cbe36afc647558994783b5f59eb77754f5f4401e1abf65fcf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1498 Malicious code in @juiggitea/velit-incidunt-beatae (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cfb6158311aa917e04e4fd1480bce5fa2373ec233fa949227dcec5307125c62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...