MAL-2022-5224 Malicious code in path-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94ae4bdfb7944796dc0ecef023b1fdff452a3a633c00fa2b7d9a6082bc689af3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-6419 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions Update 14 and earlier Adobe ColdFusion versions Update 4 and earlier Description: The issue is related to an improper restriction of XML external entity references, which could allow a remote attacker to disclose...

CVE-2022-40147

A vulnerability has been identified in Industrial Edge Management All versions V1.5.1. The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between...

CVE-2021-35226

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...

PT-2022-6444 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct versions prior to 22 FP2211 Description: An XXE issue was discovered in Nokia NetAct via an XML document to a Performance Manager page, where input validation and a proper XML parser configuration are missing. This could allow an...

PT-2022-01: XML External Entity (XXE)

Input validation and proper XML parsers configuration was missing. On the Configuration Dashboard page, an attacker can import XML files. Support of external entities External Entity is enabled for processing of such files, which leads to Arbitrary File Read and SSRF. The attack can only be...

PT-2022-5000 · Solarwinds · Network Configuration Manager

Name of the Vulnerable Software and Affected Versions: Network Configuration Manager affected versions not specified Description: The issue is related to a misconfigured entity in the Network Configuration Manager product, which exposes a password field to the Solarwinds Information Service SWIS...

PT-2022-6445 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct versions prior to 22 FP2211 Description: An XXE issue was discovered via an XML document to the Configuration Dashboard page, where input validation and a proper XML parser configuration are missing. This makes it difficult for a...

Security Bulletin: Liberty for Java for IBM Cloud is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2021-20492)

Summary There is an XML External Entity Injection XXE vulnerablility in IBM WebSphere Application Server Liberty used in Liberty for Java for IBM Cloud. This does not occur in the default configuration, it occurs when batchManagement-1.0 is configured. Vulnerability Details CVEID:CVE-2021-20492...

MAL-2022-1632 Malicious code in bmt-web-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35077ef12023da408992cf0c35a5177c73041bdba780bceb1f4fb2d5a76ed3b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

expat: a use-after-free in the doContent function in xmlparse.c

A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XMLResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags,...

expat: a use-after-free in the doContent function in xmlparse.c

A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XMLResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags,...

expat: a use-after-free in the doContent function in xmlparse.c

A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XMLResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags,...

expat: a use-after-free in the doContent function in xmlparse.c

A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XMLResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags,...

expat: a use-after-free in the doContent function in xmlparse.c

A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XMLResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags,...

Business-central: Possible XML External Entity Injection attack

An XML external entity injectionXXE vulnerability was found in Business Central. This flaw allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. T...

Malicious code in win32ipc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3e31e438e6b470732b7cb7e164d5d1e1e99003175a4e25fe50b9f687263e8cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3562 Malicious code in harness-helm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0008cf12cac94140f089a7ba2a7d297c874737f5bfbd34256de9b47b44d084bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3447 Malicious code in graphql-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1579df6eb121dfcca4111c8ed7ad074f1b52d4847ad652e6b9cb71cea45015b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authentication Bypass

Matrix Android SDK 2 is vulnerable to authentication bypass. The vulnerability exists in onRoomKeyEvent function of DefaultCryptoService.kt due to lack of entity authentication for key forwarding strategy which allows an attacker to cooperate with a malicious home server...