CVE-2022-0217

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs CWE-776. In addition, depending on the libexpa...

MAL-2022-4851 Malicious code in nibushidao-dsda-sa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63b831db25b34beca7bde32dc00f45f2c5c00a434ad0ff4a30a04fcfb5a4a92a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1862 Malicious code in ceshia-node-stack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 904b2c5f963fd4aaf932b479caed9c77968bcb1543febf18f617babba1a2444e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the Java-to-XML Apache XMLBeans tool, related to errors in processing XML entities, allows attackers to trigger a service failure or disclose protected information.

The vulnerability of the Java-to-XML Apache XMLBeans tool is related to errors in processing XML entities. Exploiting this vulnerability can allow an attacker to cause service failures or expose sensitive information...

IBM MQ XXE (6613021)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 6613021 advisory. - IBM MQ Explorer is vulnerable to an XML External Entity Injection XXE attack due to improper XML validation in the import Wizard. CVE-2022-22489 Note that Nessus has not...

MAL-2022-6198 Malicious code in social-media-icons-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca362d17a667da1d094b044be149065c8d362cc8ae8e0dbd43bfdb0e9c537df7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Enable Security Teams to Leverage Machine Learning Technologies

As on-premises and cloud-hosted data repositories get larger, they are outstripping the ability of traditional data-crunching methods to efficiently analyze the information. As a result, more enterprises have turned to data science and machine learning platforms to create business value. The...

MAL-2022-3404 Malicious code in goede.cl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf4e2b32e6ce5d6865a19df1a00e16c31c4fd60fc8f83840c4f8c931121f340c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3354 Malicious code in getmeurl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1be89eb493fb9124196b244a46451068a574ca1269ffae4f4234f6fffe4939e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3209 Malicious code in freekws-devportal-api-client-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 964e73152194b8926217ca3e0d90526fe2a0e1223ef4b99a45ebd367193ce1fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in freekws-devportal-api-client-nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6844a713c19484257db4a41fa914be2ee9dd774feb1dcec5698ce8fdb776066f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Vulnerability in XML Entity Processsing affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-8980)

Summary The product does not disable external XML Entity Processsing which can lead to information disclosure and denial of service attacks. Vulnerability Details CVEID: CVE-2016-8980 DESCRIPTION: IBM BigFix Inventory v9.x is vulnerable to a denial of service, caused by an XML External Entity...

CVE-2022-22489

IBM MQ 8.0, 9.0, 9.1, 9.2 LTS, and 9.1 and 9.2 CD are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339...

CVE-2022-22489

IBM MQ 8.0, 9.0, 9.1, 9.2 LTS, and 9.1 and 9.2 CD are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339...

Xxe

IBM MQ 8.0, 9.0, 9.1, 9.2 LTS, and 9.1 and 9.2 CD are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339...

CVE-2022-22489

CVE-2022-22489 affects IBM MQ and IBM MQ Explorer components (versions 8.0, 9.0, 9.1, 9.2 LTS and 9.1/9.2 CD). The issue is an XML External Entity (XXE) injection that occurs while processing XML data, enabling a remote attacker to access sensitive information or exhaust memory resources. The IBM...

MAL-2022-4653 Malicious code in mobx-model-xd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd03fd58f7b83df1b36fd97189d6768e243699870898f9f1ea1dad8f0bb3383d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wcebpack-bunde-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c7a4300818daab208570421a84bcdd8e7b4950dcae1e6a5dd08f17d9e135497 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6894 Malicious code in vbtgoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1c8cb40b5a81070001e4273b1442e72dbde9cba6f035c2592a96303f30c368c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7294 Malicious code in xpostcss-loadsr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7b25fd3ba45c53cf0e0120c9ca6bb1bd8b9f3ef554a6d2d5341d09e13f3ee71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...