MAL-2023-260 Malicious code in discount-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b62bcefcaea2db2548388a227a4b29129aec31ac8138d04b9763fbd8e5bb54ac Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

Regular Expression Denial Of Service (ReDoS)

fast-xml-parser is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in the readDocType function at DocTypeReader.js which allows an attacker to cause an application crash by submitting an entity name with bad preforming regex because entity names are not sanitize...

SUSE CVE-2023-34104

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

EulerOS 2.0 SP8 : pki-core (EulerOS-SA-2023-2197)

According to the versions of the pki-core package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to...

CVE-2023-34104

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

CVE-2023-34104 Regex Injection via Doctype Entities

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

Malicious code in fc-transactions-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b4aa758a82c1ef95eb8cec01a5206c1000e9ae259eab65eac788bb629690c5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-368 Malicious code in fc-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5498af06b587aada10a4ddfc1c09239a8bb5d02d6db2985601f4a0c582c404e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-crs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5a07aa52759bb73b117994269f606ebbcc2d9f4a99e9ac891447bf2652e21cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-335 Malicious code in fc-collabsible (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7cf2a1c7cafc2f63b3b6da7c03ad9e5bb35508693b37096982b17e947379aaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-345 Malicious code in fc-explanation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5a7c61119778e56e23e3e3b0e727a6e58eebb4f3fa2f739ce8a81ba608daf36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-fatca (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 737a20c9f6dbe7f64964338a685eb15657c970610dcec176f17c6340af3c6f12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-348 Malicious code in fc-foreign-address (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19696b7c9cae056f89a8ebf29870be38468039ef7d123603c9c0e42048a08668 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-564 Malicious code in legal-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 889df12ead796af3e20b965b76b67dd029c687100599b2435933f0c7e82e8f53 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-556 Malicious code in kiosk-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71fbb12b0e624a23789e7a1fdd080d82b14f3f3fdaf40a0efe97bb87cdcdff7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

fast-xml-parser 安全漏洞

fast-xml-parser is an open source library from Natural Intelligence. It is used to quickly validate XML, parse XML and build XML without C/C++ based libraries and callbacks. A security vulnerability exists in versions prior to fast-xml-parser v4.2.4 that stems from the fact that fast-xml-parser...

MAL-2023-331 Malicious code in fc-amount (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deda6264abf52468856de6a91a887594ca7b427f7093f2486999d3323f096408 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-352 Malicious code in fc-iban (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 835c3aed532f26ad6a891ed3275291ab1fda39d7c0a7e81d5420062466a514aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate

A use-after-free flaw was found in the Expat package, caused by destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. This may lead to availability disruptions...

Multiple vulnerabilities in FUJI ELECTRIC FRENIC RHC Loader

Overview FRENIC RHC Loader provided by FUJI ELECTRIC CO., LTD. contains multiple vulnerabilities listed below. Stack-based buffer overflow CWE-121 - CVE-2023-29160 Out-of-bounds read CWE-125 - CVE-2023-29167 Improper restriction of XML external entity reference CWE-611 - CVE-2023-29498 Michael...