MAL-2023-763 Malicious code in schema2x-annotations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14cc8a264046041e2d275a0a2e465eb74b50c5ff3824a6330b7253196e8b6fc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-26057

An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters su...

RHEL 8 : pki-core:10.6 (RHSA-2023:1966)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1966 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core: access to...

Russian Hackers Suspected in Ongoing Exploitation of Unpatched PaperCut Servers

Print management software provider PaperCut said that it has "evidence to suggest that unpatched servers are being exploited in the wild," citing two vulnerability reports from cybersecurity company Trend Micro. "PaperCut has conducted analysis on all customer reports, and the earliest signature ...

Security Bulletin: iText.jar in Tom Sawyer Perspective is vulnerable to XML External Entity

Summary iText.jar in Tom Sawyer Perspective is vulnerable to XML External Entity used by IBM Tivoli Network Manager ITNM IP Edition. Vulnerability Details CVEID:CVE-2017-9096 DESCRIPTION: iText PDF Library could allow a remote authenticated attacker to obtain sensitive information, caused by an X...

MAL-2023-36 Malicious code in @esmpfrontend/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2edaa6244ce4a0413da9f30fb0702f0e5ddd8dfd4d35ae03f9de1f4a815061d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-Site Scripting (XSS)

phpmyfaq is vulnerable to Cross-Site Scripting XSS attacks. The library contains a stored XSS in the Field Name category which does not properly escape before it output to the front end due to missing HTML entity conversions, which allows an attacker to execute malicious JavaScript on victim's...

MAL-2023-646 Malicious code in oc-active-conversation-module-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af2f6d15b247e3f8fc944ad0ec5d9efe55a5163b89f729f53e819289a9102e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Amazon Linux 2 : pki-core (ALAS-2023-2016)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2016 advisory. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending...

Important: pki-core

Issue Overview: Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. CVE-2022-2414 Affected Packages: pki-core Note:...

Improper restriction of XML external entity references (XXE) in Shinseiyo Sogo Soft

Overview Shinseiyo Sogo Soft provided by The Ministry of Justice improperly restricts XML external entity references XXE CWE-611. Taku Toyama of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...

JVN#73178249: Improper restriction of XML external entity references (XXE) in Shinseiyo Sogo Soft

Shinseiyo Sogo Soft provided by The Ministry of Justice improperly restricts XML external entity references XXE CWE-611. Impact By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker. Solution Update the Software Update the software to the latest...

ROS-20230419-01

Vulnerability of HFS+ partition file analyzer of ClamAV antivirus software package is related to an operation exceeding the memory buffer boundaries. operation beyond the memory buffer boundaries. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

Shinseiyo Sogo Soft 代码问题漏洞

Shinseiyo Sogo Soft is a software used by Japan's Ministry of Justice to process legal documents and information. A security vulnerability exists in Shinseiyo Sogo Soft version 7.9A and prior versions, which arises from incorrectly restricting XML external entity references...

SUSE CVE-2019-3773

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

MAL-2023-769 Malicious code in sendgram (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd1d8d9e7fe2d4bb63225ef26a1816cb63b8e72a92666345be028bff4abf77fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

Xxe

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

PT-2023-13658 · Güralp · Güralp Man-Eam-0003

Name of the Vulnerable Software and Affected Versions: Güralp MAN-EAM-0003 version 3.2.4 Description: The issue is related to an XML External Entity XXE problem via XML file upload, which can lead to local file disclosure. This occurs in the cgi-bin/xmlstatus.cgi component. Recommendations: For...

CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...