MAL-2023-191 Malicious code in cms-serviceclients-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3150363413ce714345472394bfc28e97eba6d3608025b70b28e9142230cecbd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-183 Malicious code in clientcore-onesrv-serviceclients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1e5e4f399b5f583c06f69a74d76eb6600039d400dd1e2e7d7d721e1aa2cbb61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-194 Malicious code in cms-ui-presentationlogic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1ed28c883575b30f00714232f671ed736feb78c5dcc8ab6326d2d6eacc20466 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-190 Malicious code in cms-serviceclients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6378607eb6158e7d672a2316b410a0e35babc9eb618b207d8dee2c25d1212f7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-180 Malicious code in clientcore-catalyst-businesslogic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6664041454d45a2f2b01cb74cb0c4721a9dcafb0080f39a8f4990d700aa9746f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-449 Malicious code in fluent-ui-react-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d4f214d34026a7c88fc092754888c5c4c127f5cead75c2e93a25b2a3e3cc403 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-186 Malicious code in cms-businesslogic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0db779bc3d95749d4bb288d33d42d6febc864b8ab1ce8b51b5ddba5cfac9298 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Drupal 7.x < 7.95 / 9.4.x < 9.4.12 / 9.5.x < 9.5.5 / 10.x < 10.0.5 Multiple Vulnerabilities (drupal-2023-03-15)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.95, 9.4.x prior to 9.4.12, 9.5.x prior to 9.5.5, or 10.x prior to 10.0.5. It is, therefore, affected by multiple vulnerabilities. - Drupal core provides a page that outputs the markup...

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-002

The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files. This release was coordinated with SA-CONTRIB-2023-010. This advisory is not covered by Drupal Steward...

CVE-2023-26461 XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)

SAP NetWeaver allows SAP Enterprise Portal - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files and data. It allows the attacker to view...

Fedora 38 : mingw-python-OWSLib (2023-9a878398a6)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9a878398a6 advisory. Update to OWSLib-0.28.1, fixes CVE-2023-27476. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

XML External Entity (XXE)

php-dompdf is vulnerable to XML External Entity XXE attacks. SVG images are not processed through Dompdf's resource validation logic, allowing attackers to use remote resources, local filesystem paths, and vulnerable protocols without restriction...

Intel® Quartus® Advisory

This advisory contains CVEs in Altera products and has been transferred to Altera for support. The updated advisory can be found at the link below: https://www.altera.com/product-security/advisory-archive/intel-sa-00632.html...

CVE-2023-1288

An XML External Entity injection XXE vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server...

CVE-2023-1288 ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability

An XML External Entity injection XXE vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server...

CVE-2023-1288 ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability

An XML External Entity injection XXE vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server...

CVE-2023-1288

CVE-2023-1288 affects Dassault Systèmes ENOVIA Live Collaboration V6R2013xE. The connected sources describe an XML External Entity (XXE) vulnerability that allows an attacker to read local files on the server (remote read; potential RCE not clearly stated in the documents). The root cause is an X...

XML External Entity (XXE)

owslib is vulnerable to XML External Entity XXE. The vulnerability is due to allowing lxml entity resolution, which allows an attacker to read arbitrary files by parsing a crafted XML document...

SUSE CVE-2023-27476

OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...

Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2023-1510)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...