Fedora 39 : python2.7 (2023-ea38857cc3)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ea38857cc3 advisory. Security fix for CVE-2022-48565. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Rocky Linux 8 : qt5-qtbase and qt5-qtwebsockets (RLSA-2020:4690)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4690 advisory. - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue t...

Rocky Linux 8 : prometheus-jmx-exporter (RLSA-2020:4807)

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2020:4807 advisory. - The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. CVE-2017-18640 Note that Nessus h...

SUSE: Security Advisory (SUSE-SU-2023:4367-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2023-8445 Malicious code in @inventashif/workspace-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fe4fedd5d11a10d847f74fc3fa803fcacb0f7484be032ee6b87bdb61e84ed31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in share-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba664ab24090b0fcbea9d3c7c58134f47472535eba4ff9d4a65946aa5efad8ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8462 Malicious code in print-vault-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 367bf013409840485fdaebde8da15293906ece37c6c79fd8b03396935ac7a2a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ksm-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acbd11805012facf9e6ace839d7003088cf99552b9da073484d17920f72c5d9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8457 Malicious code in fa-icdc-form-api-bdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24842401e160323f0909c7f6e561fbaa5cbdb6f3b5e3c0dfe2a4dd0fe1877e5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8452 Malicious code in bt8-wax-front-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94edc2702431bf0ca422456566133b260f48b21d456989d157837fbf5e4d80ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8448 Malicious code in airslate-error-handling-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4e66e5d16011fdd608b4f1f9fbeec95335036b7ba46f4446b4732747e1870e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML External Entity Injection

OpenCRX is vulnerable to XML External Entity injection XXE. The vulnerability is due to improper input sanitization in the DocumentBuilderFactory function . This can potentially lead to server side request forgery attacks...

CVE-2023-46802

e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references XXE due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker...

PT-2023-30228 · E-Tax · E-Tax

Name of the Vulnerable Software and Affected Versions: e-Tax software versions 3.0.10 and earlier Description: The issue is related to the improper restriction of XML external entity references XXE in the e-Tax software due to the configuration of the embedded XML parser. This allows an attacker ...

Malicious code in watchman-search-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9d31c46bc906a3eeb18b4852518f529d915f87ab7935775541759d38c18151e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Amazon Linux AMI : python27 (ALAS-2023-1880)

The version of python27 installed on the remote host is prior to 2.7.18-2.149. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1880 advisory. An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity...

e-Tax Reception System Security Vulnerability

The e-Tax Reception System is an electronic tax management system organized by the National Tax Agency NTA of Japan. A security vulnerability exists in e-Tax Reception System version 3.0.10 and earlier, which stems from an improper restriction of XML External Entity References XXE, where processi...

MAL-2023-8418 Malicious code in demo-saas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7346c8d2670e05b376c36a799aafbe36cad56e319900ab63a766fea56e0985cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: python

Issue Overview: An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. CVE-2022-48565 Affected Packages: python Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Security Bulletin: IBM Financial Transaction Manager v3.2.x is vulnerable to XML External Entity Injection (XXE)

Summary An XML External Entity Injection XXE vulnerability in Java based XML parsers within IBM Financial Transaction Manager was addressed. Vulnerability Details CVEID:CVE-2023-35892 DESCRIPTION: IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity...