MAL-2024-159 Malicious code in epsilonapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddfb4cbc67bdf6c16f4d91e84f6042e1f65a6adb6d1acca2975b483612aee913 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora 39 : fonttools (2024-6d1d9f70d2)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-6d1d9f70d2 advisory. Security fix for CVE-2023-45139 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Improper restriction of XML external entity references (XXE) in "Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version)"

Overview "Electronic Delivery Check System Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version" provided by Ministry of Agriculture, Forestry and Fisheries improperly restricts XML external entity references XXE CWE-611. Iwakawa Kento and Toyama...

Improper restriction of XML external entity references (XXE) in Electronic Deliverables Creation Support Tool provided by Ministry of Defense

Overview Electronic Deliverables Creation Support Tool provided by Ministry of Defense improperly restricts XML external entity references XXE CWE-611. Toyama Taku of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

MAL-2024-161 Malicious code in gothic-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4172096c341848a0f0d8c56be5e72561fe8d9b467aff45b6f1843bc3106a4a01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-19376 · Ministry Of Agriculture · Electronic Delivery Check System

Name of the Vulnerable Software and Affected Versions: Electronic Delivery Check System Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version versions 14.0.001.002 and earlier Description: The issue is related to the improper restriction of XML...

JVN#01434915: Improper restriction of XML external entity references (XXE) in "Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version)"

"Electronic Delivery Check System Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version" provided by Ministry of Agriculture, Forestry and Fisheries improperly restricts XML external entity references XXE CWE-611. Impact Processing a specially craft...

PT-2024-19043

Name of the Vulnerable Software and Affected Versions Electronic Delivery Check System Doboku versions 18.1.0 and earlier Electronic Delivery Check System Dentsu versions 12.1.0 and earlier Electronic Delivery Check System Kikai versions 10.1.0 and earlier Electronic delivery item Inspection...

JVN#40049211: Improper restriction of XML external entity references (XXE) in Electronic Deliverables Creation Support Tool provided by Ministry of Defense

Electronic Deliverables Creation Support Tool provided by Ministry of Defense improperly restricts XML external entity references XXE CWE-611. Impact Processing a specially crafted XML file may lead to exposure of internal files on the system. Solution Update the Software Update the software to t...

VulnCheck KEV: CVE-2020-24589

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection XXE attacks...

VulnCheck KEV: CVE-2021-27931

LumisXP aka Lumis Experience Platform before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service...

GLSA-202401-26 : Apache XML-RPC: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202401-26 Apache XML-RPC: Multiple Vulnerabilities - XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forger...

HPESBGN04569 rev.1 - HPE Unified Mediation Bus (UMB), Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Sensitive Information, URL Redirection, Unauthenticated Arbitrary Code Execution, Unauthorized Write Access to the File System, memory corruption, XML External Entity XXE, Host Header Injection; Remote: Bypass Security...

MAL-2024-144 Malicious code in syxx.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a18f7717b2f393a788bf573c56118af761b8ee733a33a527a4fdb428d339934 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2024-1080 python-fonttools security update

FontTools is a library for manipulating fonts, written in Python. The project includes the TTX tool, that can convert TrueType and OpenType fonts to and from an XML text format, which is also called TTX. It supports TrueType, OpenType, AFM and to an extent Type 1 and some Mac-specific formats. Th...

DEBIAN-CVE-2024-23525

The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the noxxe option of XML::Twig...

UBUNTU-CVE-2024-23525

The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the noxxe option of XML::Twig...

Security Bulletin: IBM Maximo Manage is vulnerable to attack due to Eclipse Jetty ( IBM X-Force ID 261776)

Summary IBM Maximo Manage is vulnerable to attack due to Eclipse Jetty IBM X-Force ID 261776 Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. ...

MAL-2024-123 Malicious code in discord.js-v12selfbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 185d6410de1e975280bd6d535f7905cd9264eacb3c2ff98813e61d1a4ae0e2b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord.js-selfbot-vl3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93b8a4d4a43d4cc9677b980b29b0c52f7767b770407fc60503959d4b1c585ca1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...