Security Bulletin: IBM MQ Explorer is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2022-22489)

Summary IBM MQ Explorer is vulnerable to an XML External Entity Injection XXE attack due to improper XML validation in the import Wizard. Vulnerability Details CVEID:CVE-2022-22489 DESCRIPTION: IBM MQ is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote...

XML External Entity (XXE)

swift is vulnerable to XML External Entity XXE attacks. The vulnerability allows a remote authenticated attacker to access potentially sensitive data in S3 buckets by persuading the S3 API into returning arbitrary file contents from the host server...

DRUPAL-CORE-2023-001

The Media Library module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access. The vulnerability is mitigated by the fact that the inaccessible media will only be visib...

DRUPAL-CONTRIB-2023-002

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. Entity Browser does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about entities they are not...

MAL-2023-798 Malicious code in speedtesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea291fb5f10bb5f4fec190257342afa539f082d724229d3316d408ba2277c5ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-797 Malicious code in speedtestkas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8836f24997a907538aecb95c00484874123e3c82cfc14af5aa48eba61723a6c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-799 Malicious code in speedtestrun (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b100bd6200644b48f81811927710a78c261d325facb39b0425c7da01f37d6f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-801 Malicious code in speedtestspa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c16c52565fd772129fa47bbfae8224b728ca331ccf58773d41d243df06bbb9de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-794 Malicious code in speedtestgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fdcbf7a838d1ab8733a1da6605dfb92935f0b70f7feaf91b79aba1fa85b685f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Entity Browser - Moderately critical - Information Disclosure - SA-CONTRIB-2023-002

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. Entity Browser does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about entities they are not...

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-001

The Media Library module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access. The vulnerability is mitigated by the fact that the inaccessible media will only be visib...

Media Library Form API Element - Moderately critical - Information Disclosure - SA-CONTRIB-2023-004

This module enables you to use the media library in custom forms without the Media Library Widget. The module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access. The...

CVE-2023-22624

Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks...

PT-2023-18594 · Zoho · Zoho Manageengine Exchange Reporter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Exchange Reporter Plus versions prior to 5708 Description: The issue allows attackers to conduct XXE XML External Entity attacks. This type of attack occurs when an application parses XML input that contains malicious extern...

ZOHO ManageEngine Exchange Reporter Plus 5708 代码问题漏洞

ZOHO ManageEngine Exchange Reporter is a hybrid Exchange and Skype for Business reporting, auditing and monitoring solution from ZOHO. A security vulnerability previously existed in ZOHO ManageEngine Exchange Reporter Plus version 5708, which stemmed from the presence of an XML external entity...

Reuse of signature to get KYCd after it has been removed

Lines of code Vulnerability details Impact There is no time limit on the validity off KYC digests and users with a removed KYC are not saved. If a issuer of such a digest is either compromised or if they by mistake issue a digest with a deadline far into the future a user could reuse the same...

libxml2: dict corruption caused by entity reference cycles

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free...

libxml2: integer overflows with XML_PARSE_HUGE

A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation...

MAL-2023-24 Malicious code in @balea-telefonica/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 563059871426877f31b5ba1bd33fda80482ee48032d184d83e400daf25d54b99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Linux 8 : libxml2 (ELSA-2023-0173)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0173 advisory. - Fix CVE-2022-40303 2136562 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...