OESA-2024-1751 python-lxml security update

The lxml XML toolkit is a Pythonic binding for the C libraries libxml2 and libxslt. \ It is unique in that it combines the speed and XML feature completeness of these libraries with \ the simplicity of a native Python API, mostly compatible but superior to the well-known ElementTree API. \ The...

ClassGraph XML External Entity Reference

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity XXE attacks...

GHSA-V2XM-76PQ-PHCF ClassGraph XML External Entity Reference

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity XXE attacks...

CVE-2021-47621

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity XXE attacks...

U.S. Bans Kaspersky Software, Citing National Security Risks

The U.S. Department of Commerce's Bureau of Industry and Security BIS on Thursday announced a "first of its kind" ban that prohibits Kaspersky Lab's U.S. subsidiary from directly or indirectly offering its security software in the country. The blockade also extends to the cybersecurity company's...

ClassGraph Security Vulnerability

ClassGraph is a super-fast parallel class path scanner and module scanner from the ClassGraph open source. A security vulnerability exists in ClassGraph versions prior to 4.8.112 that stems from an inability to defend against XML External Entity XXE attacks...

PT-2024-11501 · Unknown · Classgraph

Name of the Vulnerable Software and Affected Versions: ClassGraph versions prior to 4.8.112 Description: The issue concerns the susceptibility of ClassGraph to XML eXternal Entity XXE attacks. This means that an attacker could potentially exploit the software by injecting malicious XML code,...

CVE-2021-47621

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity XXE attacks...

CVE-2021-47621

CVE-2021-47621 is an XXE vulnerability in ClassGraph up to version 4.8.111, with the fix flighted at 4.8.112 and later. The issue arises because ClassGraph was not resistant to XML External Entity attacks, enabling an attacker to read arbitrary server files via specially crafted XML/POM inputs. P...

CVE-2023-49110 XML External Entity Injection in Kiuwan SAST

When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application either on-premises or cloud/SaaS solution, the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side processing of these XML...

CVE-2023-49110

CVE-2023-49110 describes an XML External Entity (XXE) injection in Kiuwan SAST when the Kiuwan Local Analyzer uploads scan results. The issue arises during server-side processing of XML files in a ZIP payload, where external XML entities are resolved. A privileged attacker who can scan source cod...

CVE-2023-49110 XML External Entity Injection in Kiuwan SAST

When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application either on-premises or cloud/SaaS solution, the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side processing of these XML...

U.S. Dept Of Defense: XML E██████ternal Entity (XXE) Injection in ███

The vulnerability described in CVE-2022-2414 was an XML External Entity XXE injection flaw. XXE vulnerabilities occur when an application improperly processes XML input containing references to external entities. This allowed access to arbitrary files on the server...

Malicious code in imageg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df52076c4f31a1cfa37f150398316cecaf3fa4608747f701714ca329d155e6b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13494704f154bacb5f2fc638287da1fe39acad551f086f8b5957f633ab310553 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1658 Malicious code in nt4padyp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 813b8cef8cb7a828bbbf2b8edb29b1bbba72c65e7654fe80f07a80398a9e5133 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nodem0m (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae93a7345bbc51bd2c0a267dc582cf90302284606b0f569ae06f4dc6a26f801a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1657 Malicious code in nodem0m (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae93a7345bbc51bd2c0a267dc582cf90302284606b0f569ae06f4dc6a26f801a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1644 Malicious code in pwi-cfa-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d39aaa33ecd66d4aac0437e45aa6a1cddcc74bb7ed416f6b33c3a7151cbc035 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rb-fare-breakup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25a5d54730dc9f0fde2c00fc22012602258fa2002141d77e8c09f61347a82e33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...