MAL-2024-127 Malicious code in noleakdmall (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2bc9f62148f8417bf5be1b0b2bc56a7f279b99ab37d5cf7a9c3594278020fe6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-117 Malicious code in discord.js-lock-selfbot-v13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b6ced52518f96ad1ced4f124d86601328e2898f7c62f1f619f33a4f0f202a7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-113 Malicious code in child-proces (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c848180a34155de4ca426e1b0fb5f5d6438c46d1f8c55e8af1a6ddd2bd50078b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Spreadsheet::ParseXLSX Security Vulnerability

Spreadsheet::ParseXLSX is an XLSX file parser. A security vulnerability exists in Spreadsheet::ParseXLSX versions prior to 0.30 that stems from allowing XML External Entity References XXE attacks...

Security Bulletin: IBM Maximo Asset Management is vulnerable to attack due to Eclipse Jetty ( IBM X-Force ID 261776)

Summary IBM Maximo Asset Management is vulnerable to attack due to Eclipse Jetty IBM X-Force ID 261776 Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the...

MAL-2024-107 Malicious code in djs13-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5aeb852fd37db4368a6b873b7a177bb29a5b995b6bf31738e8d8a691ed9706f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-104 Malicious code in chalk-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b0f69a9a955c3d91a271b9915114fbf4c8fa069f6358c794b9a27ab30c2df84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2023-45139

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to...

CVE-2023-45139

A flaw was found in the subsetting module of FontTools, which contains an XML External Entity Injection XXE vulnerability. This flaw allows malicious actors to exploit the parsing of candidate fonts, particularly those with an OT-SVG format that includes an SVG table. Through this vulnerability,...

MAL-2024-72 Malicious code in djs-fetcher-v14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 807836abaf822d9c2f12611b17e5551c57ca8bcd82edbaafe72b8fe7ec01e56d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-74 Malicious code in keptnwebservice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be099900c6266fdc8e56c9b32fc39db089f596f5ddb49828b3edfcc78cc689ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-73 Malicious code in gh-action-send-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4f6d4e13a5a1a14537f878bfa2d4490b5606649326d77d4b88e205a010f124b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-82 Malicious code in sh.keptn.core.control (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9b8763390772109f1229fafc67d20bf685bb577efd7263c1d76a263f844b84e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Ivanti Avalanche decode XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the decode method. Due to the improper restriction of XML External Entity XXE...

CVE-2023-45139

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to...

DEBIAN-CVE-2023-45139

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to...

UBUNTU-CVE-2023-45139

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to...

Xxe

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to...

CVE-2023-45139

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to...

CVE-2023-45139 fonttools XML External Entity Injection (XXE) Vulnerability

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to...