CVE-2020-26708

requests-xml v0.2.3 was discovered to contain an XML External Entity Injection XXE vulnerability which allows attackers to execute arbitrary code via a crafted XML file...

codehaus-plexus: XML External Entity (XXE) Injection

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtilwriteComment fails to sanitize comments for a -- sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection...

Important: Red Hat Security Advisory: Red Hat Integration Camel K 1.10.1 release security update

Red Hat Integration Camel K 1.10.1 release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Important. A security update for Camel K 1.10.1 is now...

MAL-2023-631 Malicious code in node-hsf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e30143880959f7bbf83a547cd32a89f7a338b497a3408e3b16ae74d80e6ba4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-33 Malicious code in @calizahq/react-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 736249350ff22b093bcff8631c4b2722b245bb27b2ef003fdf490a7171dc3c77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

HardHatC2 - A C# Command And Control Framework

A cross-platform, collaborative, Command & Control framework written in C, designed for red teaming and ease of use. HardHat is a multiplayer C .NET-based command and control framework. Designed to aid in red team engagements and penetration testing. HardHat aims to improve the quality of life...

Improper Access Control

remult is vulnerable to Improper Access Control. The @Entity decorator's apiPrefilter option prevents unwanted access to data by returning a filter that verifies the validity of an entity instance's id. An attacker who knows the id beforehand is able to read, update, and delete the entity instanc...

CVE-2023-3113

An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files...

CVE-2023-3113

An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files...

Xxe

An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files...

Lenovo XClarity Administrator 代码问题漏洞

Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China. The product provides agentless hardware management for servers, storage, network switches, and more. A security vulnerability exists in Lenovo XClarity Administrator LXCA that originates from an...

[SECURITY] [DLA 3470-1] owslib security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3470-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk June 25, 2023 https://wiki.debian.org/LTS -...

MAL-2023-270 Malicious code in doks-child-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 402865140408df564c64110cbb63271f62bb71a0fb29453688fa1f876accc457 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-589 Malicious code in mesos-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ca86e4f7655ee05071ef73a17f239df8dcc483b932ef71d351cf47e8435376b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-35167 When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id

Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the id of an entity instance is not authorized to access, can gain...

CVE-2023-35167 When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id

Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the id of an entity instance is not authorized to access, can gain...

XML External Entity (XXE) Injection

Overview ch.qos.reload4j:reload4j is an a fork of Apache log4j version 1.2.17 with the goal of fixing pressing security issues. Affected versions of this package are vulnerable to XML External Entity XXE Injection due to insufficient checks which do not disable the parsing of external general...

MAL-2023-826 Malicious code in sync-https-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 216dcfab006171670a40ded9fe39fcad616a3998fd0c9544be5281a40e766a60 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-23 Malicious code in @ans-exam/client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1b89ea0770827099ee6eb05d0c0345dbf2c9318531d99794a8121609dea1d43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Aspera Faspex 4.4.2 PL3 has addressed multiple vulnerabilities (CVE-2023-27871, CVE-2023-27873, CVE-2023-27874)

Summary This Security Bulletin addresses security vulnerabilities that have been remediated CVE-2023-27871, CVE-2023-27873 and mitigated CVE-2023-27874 in IBM Aspera Faspex 4.4.2 PL3. Vulnerability Details CVEID:CVE-2023-27874 DESCRIPTION: IBM Aspera is vulnerable to an XML external entity...