Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities

Summary Security vulnerabilities have been addressed in IBM Cognos Analytics 11.1.7 Fix Pack 7. These vulnerabilities have also been previously addressed in IBM Cognos Analytics 11.2.4 and 11.2.4 FP1. IBM WebSphere Liberty used in IBM Cognos Analytics is vulnerable to an HTTP Header Injection...

MAL-2023-453 Malicious code in font-forno (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71a5b24a13fdcf033190873535da22c0b00d1200f4ea936fbaa8a0883a1b6ce3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

codehaus-plexus: XML External Entity (XXE) Injection

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtilwriteComment fails to sanitize comments for a -- sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection...

MAL-2023-760 Malicious code in santander-portal-node-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d1fb57cea3e1f21e52c22b2fb33191996e04c3aef96c7b9cf1fc6184b6d0883 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-610 Malicious code in music-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01508d334e0bbe8458f00ca13978e861399e796f527f528b23fd9bbcd55000c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ManageEngine AssetExplorer < 6.9 Build 6989 XXE

An XML external entity XXE vulnerability exists in ManageEngine AssetExplorer 6.9 Build 6980 through Build 6988. A threat actor with the SDAdmin role can configure a malicious server to return a response with a malformed XML using the Reports integration API, causing an XML External Entity XXE...

Amazon Linux AMI : libxml2 (ALAS-2023-1743)

The version of libxml2 installed on the remote host is prior to 2.9.1-6.6.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1743 advisory. parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the...

ManageEngine ServiceDesk Plus MSP < 14.2 Build 14200 XXE

An XML external entity vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 14.2 Build 14200. A threat actor with the SDAdmin role can configure a malicious server to return a response with a malformed XML using the Reports integration API, causing an XML External Entity XXE attack...

Medium: libxml2

Issue Overview: parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name. CVE-2017-16931 GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Liquibase

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Liquibase. Vulnerability Details CVEID:CVE-2022-0839 DESCRIPTION: Liquibase is vulnerable to XML external entity processing, caused by improper validation of user-supplied input by the...

MAL-2023-144 Malicious code in brightening (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93f608a64371ba824fe1a9cb149fcb84fb28888dc3e8aa8c5aef1f5bf6e2a83f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1168 Malicious code in editor-layer-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c27267283420f53586172a7d6b227c424aeb92e63c242a01287112a092a7247a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-527 Malicious code in ing-orange-lu-luxtrust-oaw-mobile-authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c47e898a8d28683ffbebd031a0d10c1a1d610661c8b876689bdc85931ceda9f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EulerOS Virtualization 2.9.0 : libxml2 (EulerOS-SA-2023-1660)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option...

CVE-2023-29443

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint...

CVE-2023-28009

HCL Workload Automation is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2023-28008

HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2023-28009

HCL Workload Automation is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

Xxe

HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

Xxe

HCL Workload Automation is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...