PT-2023-31635 · Jenkins · Jenkins Nexus Platform Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML. The plugin does not...

PT-2023-8279 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche affected versions not specified Description: The issue is related to an XML External Entity XXE vulnerability in the Smart Device Server, which could allow an unauthenticated attacker to leak data or perform a Server-Side...

CVE-2023-6194

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition DTD references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to...

CVE-2023-6194

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition DTD references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to...

UBUNTU-CVE-2023-6194

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition DTD references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to...

CVE-2023-6194

CVE-2023-6194 affects Eclipse Memory Analyzer (versions 0.7 to 1.14.0). The issue arises because report definition XML files do not filter references to external entities in DTDs, allowing a malicious report file to cause the tool to access external files or URLs defined via a DTD when generating...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current libxml2 Multiple Vulnerabilities (SSA:2023-343-01)

The version of libxml2 installed on the remote host is prior to 2.12.2. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-343-01 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser...

MAL-2023-8677 Malicious code in sentrybrowser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d612638266f3e357a904ecb6eb51c3d2579e19d19916e47b18615e802b311f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XXE (XML External Entity Injection) jackson-databind in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.20.0, 9.4.0, 9.5.0, and 9.6.0 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows ...

MAL-2023-8673 Malicious code in kindly-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3df19034df58ae63ea16e04d79827be967105dfe24a2074dea497a46268c1910 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

apache-ivy: XML External Entity vulnerability

Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy...

gradle: Possible local text file exfiltration by XML External entity injection

A flaw was found in Gradle. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack OOB-XXE, parsing XML can lead to the exfiltration of local text files to a remote server. In most cases, Gradle parses XML files it...

MAL-2023-8670 Malicious code in react-hook-form-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0cf2d07005ec432f85b35387c34d03f3229f9aaeeff947232ac2f58f6015853 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8662 Malicious code in pdf2teste (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f9095d50fddeb1e4dbe750872479447be6f524bb0a38dc61daab6937f8b2a88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pdf2htmlex2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd0d21663f1e0a9150efc4b88eeda8c0782a58190e530f5eae2d27511a8d8c10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apache Cocoon XML External Entity Injection Vulnerability

Apache Cocoon is the United States Apache Apache Foundation of a component-based Web development concepts built Web application framework. Apache Cocoon suffers from an XML External Entity Injection vulnerability that arises from a network system or product that does not have the correct filters ...

MAL-2023-8657 Malicious code in testepoc20232 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dd5987640ec3b65ed0eff65c7d86690471fd73590b96b95eb64f407e8a6dd74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8652 Malicious code in cannotdelete (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05bb625bfc6b79438d4640ec1ac56dc05c2aae9ab8d9ed8bc080896f5af18253 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2023-1881 qt security update

Qt pronounced as "cute", not "cu-tee" is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo ...

OESA-2023-1878 qt security update

Qt pronounced as "cute", not "cu-tee" is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo ...