CVE-2024-7098

CVE-2024-7098 corresponds to an Improper Restriction of XML External Entity Reference in SFS Consulting WW.Winsure prior to version 4.6.2, enabling XML Injection. Multiple connected sources (NVD, Red Hat, CVE list) confirm affected product and root cause. Impact is rated critical (high confidenti...

MAL-2024-8879 Malicious code in halifax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58b7d4d1c1a8e8e2720f2b6394db65819f21bc67f442635e470d6fecaa349545 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8877 Malicious code in afe-host-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d80291bc2fb747c24552e0b6b0ca98fd26e244004fe5a804870a1be5e54a4e0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

rexml: DoS vulnerability in REXML

A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file...

SFS Consulting ww.Winsure 代码问题漏洞

SFS Consulting ww.Winsure is an application from SFS Consulting, Inc. A code issue vulnerability exists in SFS Consulting ww.Winsure versions prior to 4.6.2 that stems from an improperly restricted XML external entity reference that allows XML injection...

PT-2024-38073 · Sfs Consulting · Ww.Winsure

Name of the Vulnerable Software and Affected Versions: ww.Winsure versions prior to 4.6.2 Description: The issue is related to an Improper Restriction of XML External Entity Reference vulnerability, which allows for XML Injection. This vulnerability exists in the SFS Consulting ww.Winsure softwar...

The vulnerability of the libexpat library for analyzing XML files stems from improper restrictions on links to external XML entities, allowing attackers to execute arbitrary code.

The vulnerability of the libexpat library for analyzing XML files is related to improper restrictions on links to external XML entities. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

VulnCheck KEV: CVE-2023-45727

North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity XXE reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack...

CLSA-2024-1726163032 expat: Fix of 3 CVEs

The release version was raised because it corresponds to version 13 - CVE-2024-45490: reject negative len for XMLParseBuffer to prevent improper restriction of XML External Entity Reference - CVE-2024-45491: prevent integer overflow in dtdCopy - CVE-2024-45492: prevent integer overflow in...

CVE-2024-37397

An External XML Entity XXE vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets...

CVE-2024-37397

An External XML Entity XXE vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets...

Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2024-2450)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2024-2377)

According to the versions of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function of lxml before v4.9.1 allows attackers to access sensitive...

Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2024-2377)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP10 : python-lxml (EulerOS-SA-2024-2427)

According to the versions of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function of lxml before v4.9.1 allows attackers to access sensitive...

EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2024-2402)

According to the versions of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function of lxml before v4.9.1 allows attackers to access sensitive...

MAL-2024-8872 Malicious code in quickread (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f630b92e6f63b18cbb46723f537d664a3aa6d2871a8d3add8834ec33f9d9e40f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8871 Malicious code in quickcolor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8187ba323a5e9587ea1b3fa14930b78a581a752826decd686ec9ceec9611f0b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8866 Malicious code in leaktopus-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83373d23f7e3f374eb8fc44cfa92d26ccef29ba9113f260f71e58d6dda5eea67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8870 Malicious code in publish-test-result-screenshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf2cd13f851593ee5dc61c5c17c22a1efa0d43ec11f32023e7dfecfdd1c76adb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...