Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2024-1586)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2024-1564)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-6769-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in fadam-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12fcfc7812a4dfc264dcd39b512b18975f587ef0aaf4a667af7a7bbcdbe6ef58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1354 Malicious code in @content-platform/fadam-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38b39e3ee36cc6bc7c45845d588a859e0f041b0ecbc3caaebd1ff022e1fe7132 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

USN-6769-1: Spreadsheet::ParseXLSX vulnerabilities

Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a denial of service condition. CVE-2024-22368 An Pham discovered that Spreadsheet::ParseXLSX...

USN-6769-1 libspreadsheet-parsexlsx-perl vulnerabilities

Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a denial of service condition. CVE-2024-22368 An Pham discovered that Spreadsheet::ParseXLSX...

CVE-2024-34345 @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1...

CVE-2024-34345

CVE-2024-34345 affects the CycloneDX JavaScript library (cyclonedx-library) core functionality. The vulnerability arises from XML External Entity (XXE) injections when using the provided XML Validator on arbitrary input in version 6.7.0; it was fixed in 6.7.1. Affected component/file is the XML v...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights

Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about security vulnerabilities affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

XML External Entity (XXE) Injection

@cyclonedx/cyclonedx-library is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper XML parsing configuration within xmlValidator.node.ts, allowing an attacker to potentially access sensitive files or execute malicious code through crafted XML entities...

Exploit for Improper Restriction of XML External Entity Reference in Ivanti Endpoint_Manager

PoC Exploits Collection This repository contains proof-of-con...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2024-1586)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. CVE-2023-52426 Note that Tenable Network...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2024-1564)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. CVE-2023-52426 Note that Tenable Network...

MAL-2024-1342 Malicious code in @assistedtax/demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec2972fb44126ef7f02e56ab9b4935acea7521aebc2b5ef541889cb59b6bcd20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-38GF-RH2W-GMJ7 @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

Impact XML External entity injections could be possible, when running the provided XML Validator on arbitrary input. POC js const Spec: Version , Validation: XmlValidator = require'@cyclonedx/cyclonedx-library'; const version = Version.v1dot5; const validator = new XmlValidatorversion; const inpu...

@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

Impact XML External entity injections could be possible, when running the provided XML Validator on arbitrary input. POC js const Spec: Version , Validation: XmlValidator = require'@cyclonedx/cyclonedx-library'; const version = Version.v1dot5; const validator = new XmlValidatorversion; const inpu...

Security Bulletin: IBM Observability with Instana is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana build 271 Vulnerability Details CVEID:CVE-2023-5363 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an incorrect cipher key and IV length processing during the...

MAL-2024-1343 Malicious code in bot-login-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 466263e8cbd2152f68613171597ebbfc45204feb62846eea580ccd128e30f498 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1345 Malicious code in generic-synthetic-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3db423ccee00e5cf1e26ff844a773827eec7a87a0f1d2a41fa7d587d99b7c5c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...