Xxe

Apache Calcite 1.22.0 introduced the SQL operators EXISTSNODE, EXTRACTXML, XMLTRANSFORM and EXTRACTVALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity XXE attack. Therefore any client exposing these operators,...

PT-2022-5789 · Apache · Apache Calcite

Name of the Vulnerable Software and Affected Versions: Apache Calcite versions prior to 1.32.0 Description: The issue is related to the SQL operators EXISTS NODE, EXTRACT XML, XML TRANSFORM, and EXTRACT VALUE not restricting XML External Entity references in their configuration, making them...

CVE-2022-39135 Apache Calcite: potential XEE attacks

Apache Calcite 1.22.0 introduced the SQL operators EXISTSNODE, EXTRACTXML, XMLTRANSFORM and EXTRACTVALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity XXE attack. Therefore any client exposing these operators,...

CVE-2022-39135 Apache Calcite: potential XEE attacks

Apache Calcite 1.22.0 introduced the SQL operators EXISTSNODE, EXTRACTXML, XMLTRANSFORM and EXTRACTVALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity XXE attack. Therefore any client exposing these operators,...

Exposure of "Forgot Password" Token on Threads Controller Leads to Account Takeover

Description Hello there! Hope you are doing great! I kept looking for issues that are similar to CVE-2022-3019, and ended up finding one more, it's in the Thread entity, and I found it by looking at the /api/threads/:appid/all endpoint. It retrieves sensitive information about every user that's i...

mysql-connector-java: unauthorized access to critical

MySQL Connector/J has no security check when external general entities are included in XML sources, consequently, there exists an XML External EntityXXE vulnerability. A successful attack can access critical data and gain full control/access to all MySQL Connectors' accessible data without any...

MAL-2022-3893 Malicious code in internallib_v216 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 144eaae99291d0024df31c1ab7bdeb913ed704c53fd44a57a52a40df3c21cffd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3905 Malicious code in internallib_v742 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7079491b21b3c5b35e45256b6f4d8f2ec284503799b0dbb5bfc4aa4607621df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Five Steps to Integrating a Data Repository Vulnerability Assessment Into A WAF–Driven Vulnerability Management Program

A vulnerability assessment is a systematic review of security weaknesses in an information system. It evaluates if the system is susceptible to any known vulnerabilities, assigns severity levels to those vulnerabilities, and recommends remediation or mitigation, if and whenever needed. There are...

XML External Entity (XXE)

mei2volpiano is vulnerable to XML External Entity XXE. The use of unsafe xml.etree library allows an attacker to parse malicious XML via the filename parameters to cause denial of service...

MAL-2022-5999 Malicious code in selfbot-developer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad50680518a318baa91268329849f5e6f2f18ec0474a858615ac9381ec3818cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6863 Malicious code in useevil (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64532de08f717f9b8b574fc60b379cbe7db0f9ad3c687830222af7b3fe126a34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wvvbch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cf85aea835d80198c06087cf0bd4dfe448415bd394e75bd3a2709ba66193bcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-6XM7-3CC5-47F9 MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)

DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity XXE, leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input...

MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)

DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity XXE, leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input...

The vulnerability of the DOMDeserializer component in the FasterXML jackson-databind library allows attackers to execute XXE attacks.

The vulnerability of the DOMDeserializer component in the FasterXML jackson-databind library is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a remote attacker to perform XXE attacks...

DRUPAL-CONTRIB-2022-055

This module enables you to restrict content via taxonomy terms and related permissions. The module doesn't sufficiently restrict cached content in certain circumstances. This vulnerability is mitigated by the fact that it only occurs when multiple entity types are enabled in the module...

CVE-2022-37189

DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity XXE, leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input...

CVE-2022-37189

DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity XXE, leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input...

Xxe

DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity XXE, leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input...