18840 matches found
YamlBeans 代码问题漏洞
YamlBeans is an open source library from Esoteric Software. Can be easily Java object graph with YAML. A security vulnerability exists in Esoteric Software YamlBeans 1.15 and earlier versions, which stems from the ability of a carefully crafted YAML document to perform an XML entity expansion...
CVE-2023-24620
An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size,...
CVE-2023-24620
Esoteric YamlBeans (1.15 and earlier) contains a YAMLReader XML Entity Expansion vulnerability. A crafted YAML document exploits the YAML Anchor feature, allowing small inputs to expand to large sizes and trigger high CPU/memory usage, including Java OOMs. Connected sources corroborate the issue ...
CVE-2023-24620
An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size,...
MAL-2023-7899 Malicious code in fca-orion (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd59dfedf3ade34334f9cf2dc633000689c8ecfd2cc95b32b53e7723841c0fe3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-7900 Malicious code in fca-spbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a8ff7a08abab44b5a236e031340c492d901250c279d87f7078124850ecad03e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2023-27484 · Lg · Lg Simple Editor
Name of the Vulnerable Software and Affected Versions: LG Simple Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this issue. The specif...
PT-2023-27485 · Lg · Lg Simple Editor
Name of the Vulnerable Software and Affected Versions: LG Simple Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this issue. The specif...
PSF-2023-5 XML External Entity issue in plistlib module
An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities...
PT-2023-27482 · Lg · Lg Simple Editor
Name of the Vulnerable Software and Affected Versions: LG Simple Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this issue. The specif...
(0Day) LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the copyContent command. Due to the improper restriction ...
Updated php packages fix security vulnerability
Libxml - GHSA-3qrf-m4j2-pcrr Security issue with external entity loading in XML without enabling it. CVE-2023-3823 Phar - GHSA-jqcx-ccgc-xwhv Buffer mismanagement in phardirread CVE-2023-3824...
CLSA-2023-1692817457 Fix CVE(s): CVE-2023-3823, CVE-2023-3824
SECURITY UPDATE: external entity loading in XML without enabling it - debian/patches/CVE-2023-3823.patch: sanitize libxml2 globals before parsing. - CVE-2023-3823 SECURITY UPDATE: buffer mismanagement in phardirread - debian/patches/php-upstream-CVE-2023-3824.patch: fix buffer mismanagement in...
CLSA-2023-1692817120 php: Fix of 2 CVEs
CVE-2023-3823: Fix external entity loading in XML without enabling by1 sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phardirread...
Security issue with external entity loading in XML without enabling it
...
MAL-2023-1545 Malicious code in gradient-function (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d41bbe2c82b0cb7c5410006430478c3cc70133f726eda4f584c0f7f943ff938 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Ivanti Avalanche decodeToMap XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the decodeToMap method. Due to the improper restriction of XML External Entity...
Debian dla-3539 : libqt4-dbg - security update
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3539 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3539-1 [email protected]...
