CVE-2022-43941 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference...

CVE-2022-43941

CVE-2022-43941 affects Hitachi Vantara Pentaho Business Analytics Server prior to 9.4.0.1 and 9.3.0.2 (including 8.3.x). The issue is that the Post Analysis service endpoint of the data access plugin does not properly protect against XML External Entity (XXE) references, a root-cause that can lea...

MAL-2023-606 Malicious code in mobile-coin-block-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55fa1745bad5c1749dccb8fbb0dcfe3d2d1046ffe8df941579b0ad26de5713c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-553 Malicious code in kemnasa-sp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11e53e1596af827447edef4919e4a6f003dcb35cfd0e674d6062c2a626982249 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-653 Malicious code in omnigodz_testpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b71e35f587d48902bd1b3b26de78a66c82c7f28faf7e7d339b607497d40cc318 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-584 Malicious code in marketplace-frontend-client-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 231fca4de1cd3761739b51c0c7ba94f780a30a928f3c5de01d9008d4eb7470d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-8J88-2HFC-5RF3 Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks

Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control VS Code Metrics File contents to have Jenkins parse a crafted XML document that uses external entities for extraction of...

GHSA-VQ5H-QGXM-2M39 Jenkins Crap4J Plugin vulnerable to XML external entity (XXE) attacks

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control Crap Report file contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins...

GHSA-58CH-C2JF-5G23 Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks

Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secret...

Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks

Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secret...

CVE-2023-28680

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-28683

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-28682

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-28681

Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-28682

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Xxe

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Xxe

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Security Bulletin: Vulnerability from Apache Calcite affect IBM Operations Analytics - Log Analysis (CVE-2022-39135)

Summary In Apache Calcite, the SQL operators do not restrict XML External Entity references in their configuration. This makes them vulnerable to a potential XML External Entity XXE attack. Vulnerability Details CVEID:CVE-2022-39135 DESCRIPTION: Apache Calcite is vulnerable to an XML external...

Malicious code in tdv2-applet-stream-her (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61f1a3a4e828660101ffe77b0a2ddc778e1877603d971ba4e76e4f7d85692a34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-833 Malicious code in td-service-canvas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 795a528873994ea135446c861a7fc9cb20977c13cafcb0b58ecc4f691614de90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...