MAL-2023-491 Malicious code in hardhat-manage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c715606ed1f31065a073bcd5c09d01c86c31360cb2c2f583f93d5896dc06f188 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Xxe

External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3...

CVE-2016-15026

A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The pat...

SUSE CVE-2023-1077

In the Linux kernel, picknextrtentity may return a type confused entry, not detected by the BUGON condition, as the confused entry will not be NULL, but listhead.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused...

teler-waf 跨站脚本漏洞

teler-waf is a Go HTTP middleware that provides teler IDS functionality to prevent Web-based attacks and improve the security of Go-based Web applications. It is highly configurable and easy to integrate into existing Go applications. A security vulnerability exists in teler-waf versions prior to...

MAL-2023-909 Malicious code in tsang-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b349833c412697b8091d1f61d201e3f3d2a4790697fb032342d7cf857782bbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML External Entity (XXE)

UReport2 Core Project is vulnerable to XML External Entity XXE. The vulnerability exists due to the parse function in ReportPaser.java because the interface for saving reports does not sanitize external entity references when parsing XML data allowing an attacker to submit a malicious XML file...

CVE-2023-26043

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity XXE injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version...

Xxe

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity XXE injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version...

PYSEC-2023-15

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity XXE injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version...

Security Bulletin: IBM CloudPak foundational services (Events Operator) is affected by potential data integrity issue (CVE-2020-25649)

Summary The IBM Cloud Platform Common Services Events Operator is potentially vulnerable to a data integrity issue Vulnerability Details CVEID:CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properly...

CVE-2023-26043 XML External Entity (XXE) injection in GeoServer style upload functionality

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity XXE injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version...

CVE-2023-26043 XML External Entity (XXE) injection in GeoServer style upload functionality

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity XXE injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version...

GeoServer 代码问题漏洞

GeoServer is an open source software server written in Java. It allows users to share and edit geospatial data. A security vulnerability exists in GeoNode versions prior to 4.0.3, which stems from the presence of an XML External Entity XXE injection vulnerability that can be exploited by an...

PT-2023-20446 · Geoserver +1 · Geoserver +1

Name of the Vulnerable Software and Affected Versions: GeoNode versions prior to 4.0.3 Description: GeoNode is vulnerable to an XML External Entity XXE injection in the style upload functionality of GeoServer, leading to Arbitrary File Read. The issue arises from the dataset style upload view,...

MAL-2023-256 Malicious code in discord.js-hakaiw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c26a0c3867c1e183eee88f0eb989c91e58f92e1b05491da0461a4d927c41b1d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-24189

An XML External Entity XXE vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile...

Xxe

An XML External Entity XXE vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile...

Security Bulletin: Vulnerabilities found within Apache Storm that is used by IBM Tivoli Network Manager (ITNM) IP Edition

Summary Vulnerabilities found within Apache Storm CVE-2020-25649, CVE-2020-36518, CVE-2021-22569, CVE-2021-38153 that is used by IBM Tivoli Network Manager ITNM IP Edition Vulnerability Details CVEID:CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected securit...

MAL-2023-118 Malicious code in azure-sp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab35ecf5841fc1bbe30f36a8c3e9616e81696c4ead1dbf90145dd3728cbd36a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...