18884 matches found
MAL-2022-7101 Malicious code in webpack-dev-fixture (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ef02287b144b28d10ac4910d268b3a6ad2c870385d1ae85c1ec2f144b176c58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6289 Malicious code in stale-props (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65b9ec16df0705291e585234cf48aa58f355eadeaf165424181e35c728757468 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in webpack-dev-fixture (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ef02287b144b28d10ac4910d268b3a6ad2c870385d1ae85c1ec2f144b176c58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PortlandLabs Concrete CMS 跨站脚本漏洞
PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site scripting vulnerability exists in Concrete CMS concrete5 versions prior to 8.5.10 and 9.0.0 through 9.1.2, which stems from allowing association with a...
PT-2022-27005 · Unknown · Concrete Cms
Name of the Vulnerable Software and Affected Versions: Concrete CMS formerly concrete5 versions below 8.5.10 Concrete CMS formerly concrete5 versions 9.0.0 through 9.1.2 Description: The issue allows for XXE based DNS requests, which can lead to IP disclosure. This occurs due to a vulnerability i...
CVE-2022-45194
CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure...
AlmaLinux 8 : pki-core:10.6 and pki-deps:10.6 (ALSA-2022:7470)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:7470 advisory. pki-core: access to external entities when parsing XML can lead to XXE CVE-2022-2414 Tenable has extracted the preceding description block directly from the...
Bruhn NewTech CBRN-Analysis 代码问题漏洞
Bruhn NewTech CBRN-Analysis is an advanced, off-the-shelf CBRN defense knowledge management software application from Bruhn NewTech. It provides knowledge management, hazard prediction, and warning and reporting W&R capabilities to support operational planning and execution. A security...
Exploit for Improper Restriction of XML External Entity Reference in Wordpress
WordPress CVE-2021-29447 exploit Exploit WordPress Media Libr...
OESA-2022-2080 libxml2 security update
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The outputcan be a simple SAX stream...
OESA-2022-2082 libxml2 security update
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...
OESA-2022-2081 libxml2 security update
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...
PT-2022-27424 · Unknown · Cbrn-Analysis
Name of the Vulnerable Software and Affected Versions: CBRN-Analysis versions prior to 22 Description: The issue allows XXE attacks via an XML document, leading to NTLMv2-SSP hash disclosure. This occurs when processing a malicious XML document. Recommendations: For versions prior to 22, update t...
MAL-2022-195 Malicious code in @dbk-legacy/roster-modules-ebanking (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a784237339043670e7c7a052df02d3c57360fff4edfd7235e87e8e279975964c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cisco Firepower Management Center Software XML External Entity Injection Vulnerability
A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to view sensitive information. This vulnerability is due to insufficient validation of the XML syntax when importing a...
APT29 Exploited a Windows Feature to Compromise European Diplomatic Entity Network
The Russia-linked APT29 nation-state actor has been found leveraging a "lesser-known" Windows feature called Credential Roaming following a successful phishing attack against an unnamed European diplomatic entity. "The diplomatic-centric targeting is consistent with Russian strategic priorities a...
Mageia: Security Advisory (MGASA-2022-0412)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security Bulletin: IBM Security Guardium is affected by a postgresql-42.0.0.jar vulnerability
Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID:CVE-2020-13692 DESCRIPTION: PostgreSQL JDBC Driver could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data. By sending...
