XML Entity Expansion (XEE)

symfony/validator is vulnerable to XML Entity Expansion. The vulnerability is caused by improper XML parsing configuration, which could result in XML Entity Expansion XEE attacks that can lead to excessive memory use and potential Denial of Service DoS...

MAL-2024-1505 Malicious code in co-pilot-auth_web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d490be43502540c62a740310c0ab3d38a35220e7b32f029a0c7e79e191104015 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1524 Malicious code in seller-journey-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 503e20152f64ee06b84916ab160644ed8a89c688c4562ec22c13d23732fb7b5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1516 Malicious code in eslint-config-bragi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 729e851afe55af274e357a46544f9bd048813b8ce8f08f586c4c9d0146faa3a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML Entity Injection Vulnerability in Electronic Document Security Management System of Beijing Yisaitong Technology Development Co.

Beijing Yisetong Technology Development Co., Ltd. is a domestic data security, network security and security services provider of three major business. An XML entity injection vulnerability exists in the electronic document security management system of Beijing Yisetong Technology Development Co....

RHEL 5 : xmlsec1 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - xmlsec1: xmlsec vulnerable to external entity expansion CVE-2017-1000061 Note that Nessus has not tested for this...

RHEL 6 : lucene (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - Solr: Code execution via entity expansion CVE-2017-12629 Note that Nessus has not tested for this issue but has...

RHEL 7 : libxml2 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - libxml2: Missing validation for external entities in xmlParsePEReference CVE-2017-7375 - The...

RHEL 8 : python (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - python: tarfile module directory traversal CVE-2007-4559 - python: RecursionError: maximum recursion dept...

RHEL 6 : python (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - python: Heap overflow in zipimporter module CVE-2016-5636 - python: Integer overflow in...

RHEL 6 : perl-xml-libxml (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - perl-XML-LibXML: Use-after-free by controlling the arguments to a replaceChild call CVE-2017-10672 - The...

RHEL 7 : perl-xml-libxml (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - perl-XML-LibXML: Use-after-free by controlling the arguments to a replaceChild call CVE-2017-10672 - The...

RHEL 7 : activemq (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - Spring Framework: XML External Entity XXE injection flaw CVE-2013-6429 Note that Nessus has not tested for this iss...

RHEL 7 : soappy (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - SOAPpy: XML External Entity XXE flaw CVE-2014-3242 - SOAPpy 0.12.5 does not properly detect recursion...

RHEL 4 : openoffice.org (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - raptor: XML External Entity XXE attack via RDF files CVE-2012-0037 Note that Nessus has not tested for this issue b...

RHEL 5 : perl-xml-libxml (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - perl-XML-LibXML: Use-after-free by controlling the arguments to a replaceChild call CVE-2017-10672 - The...

RHEL 6 : gradle (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gradle: Possible local text file exfiltration by XML External entity injection CVE-2023-42445 - gradle:...

RHEL 4 : ruby (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ruby: DL::dlopen could open a library with tainted library name CVE-2009-5147, CVE-2015-7551 - The REXML...

EulerOS 2.0 SP11 : expat (EulerOS-SA-2024-1798)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time.CVE-2023-52426 Tenable has extracted the precedi...

RHEL 6 : batik (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - batik: XML external entity processing vulnerability CVE-2017-5662 - batik: information disclosure when...