CVE-2024-22219

XML External Entity XXE vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution RCE, or...

Ivanti Avalanche decodeToMap XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the decodeToMap method. Due to the improper restriction of XML External Entity...

Security Bulletin: IBM Planning Analytics is affected by vulnerabilities in IBM Java and IBM Websphere Application Server Liberty

Summary There are vulnerabilities in IBM® Java™ Version 8 and IBM WebSphere Application Server Liberty used by both IBM Planning Analytics and IBM Planning Analytics Workspace. With respect to IBM Planning Analytics, applicable CVEs have been addressed by upgrading to non-vulnerable versions of...

Security Bulletin: Vulnerability in jackson-databind affects watsonx.data

Summary FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception and other causes Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception. By...

Spring Framework DoS via conditional HTTP request

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

CVE-2024-34102 ★ Thanks to @th3gokul, Sanjaith3hacker, Chocapi...

PT-2024-8675 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.1 Description: The issue is related to an XML External Entity XXE flaw in the SmartDeviceServer component of Ivanti Avalanche. This flaw allows a remote unauthenticated attacker to read arbitrary files on the...

Voltronic Power ViewPower XML External Entity Injection Vulnerability

Voltronic Power ViewPower is Voltronic Power's monitoring and management software for solar inverters. Voltronic Power ViewPower Pro suffers from an XML external entity injection vulnerability that can be exploited by attackers to disclose sensitive information...

CVE-2024-42482 fish-shop/syntax-check Improper Neutralization of Delimiters

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Liberty impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent.

Summary Multiple vulnerabilities in IBM WebSphere Liberty impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. Vulnerability Details CVEID:CVE-2024-25026 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Libert...

Security Bulletin: Maximo Application Suite - IBM WebSphere Application Server Liberty is vulnerable to CVE-2024-22354 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses WebSphere Application Server Liberty which is vulnerable to CVE-2024-22354. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere Application...

Security Bulletin: IBM DataPower Gateway vulnerable to XML Entity Expansion attack in Web UI (CVE-2022-31775)

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2022-31775 DESCRIPTION: IBM DataPower Gateway is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memo...

CVE-2024-6893

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources...

Malicious code in iva-react-web-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94e079d8c7b731da869ff846e164d4a9c87faed0108d764e4048bde129a25f17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7942 Malicious code in click-action-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 863f4bd9c81749474f2360ad027e111369d13c2c699078f5ae2311e627b0d2fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dx-virtual-assistent-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b41db1f1208b92ea920b51ff3e83bf1718e6d1e551159eb752a0325961c9fd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rewards-mfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9ae777e44ee20450239b36c3e7d5c2a326fbe7d4e42615a39ae120cc799e963 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7952 Malicious code in dx-virtual-assistent-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b41db1f1208b92ea920b51ff3e83bf1718e6d1e551159eb752a0325961c9fd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7958 Malicious code in frontend-static-props-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb3f52abf232df0db4fc9cbe55d6234cff445cff215bbeb3e5a26a4f26b843a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7982 Malicious code in react-hook-form-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7657179ab2d7f76638491093d7c970bd9685b7228d96bf1014ee8ea15606c45a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...