XML Entity Expansion (XXE)

ebookmeta is vulnerable to an XML External Entity XXE vulnerability. The vulnerability is due to improper handling of crafted XML input via the lxml dependency in the ebookmeta.getmetadata function, allowing attackers to access sensitive information or cause a Denial of Service DoS...

XML Entity Expansion (XXE)

ebookmeta is vulnerable to an XML External Entity XXE vulnerability. The vulnerability is due to improper handling of crafted XML input in the ebookmeta.getmetadata function, allowing attackers to access sensitive information or cause a Denial of Service DoS...

Malicious code in ato-z-web-identity-components-app-cdk-adp-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c33c62d31d74de8fa6a7a3911507ce9a8d513bccb45ff1b51b7fbb9068920d3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1594 Malicious code in atoz-attendance-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff390162beebf06ba564766a3ffc0a06c520792994c16cba3ea0d97ea64d1f29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM® Db2® NSE (Net Search Extender) is affected by a vulnerability in the open source Expat library. (CVE-2024-28757)

Summary IBM® Db2® NSE Net Search Extender is affected by a vulnerability in the open source Expat library. Vulnerability Details CVEID:CVE-2024-28757 DESCRIPTION: libexpat could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity XXE...

Arbitrary Code Execution through Improper Restriction of XML External Entity Reference (XXE) vulnerability

More info at https://helpx.adobe.com/security/products/magento/apsb24-40.html...

MAL-2024-1568 Malicious code in apl-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c9d01a1289fd5e02d94728d6b0a19ec77687aadfde1e9807050227a0de03dc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1579 Malicious code in mmsdk-apml-htmlrenderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae0814f13d1d5f49711b30a6fe260c2bfb566047df1b02774e899421faf58c92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1585 Malicious code in workerd-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 864f13e0626ddbb05fb951a4a4217000d4d74c0e9935d0ca041b22f805b1ff98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

HPESBGN04655 rev.1 - HPE Unified Topology Manager (UTM), Multiple Vulnerabilities

Potential Security Impact: Remote: Cross-Site Request Forgery CSRF, Denial of Service DoS, Unauthorized Code Execution, Unauthorized Execution of Arbitrary Code, XML External Entity XXE SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified Topology Manager UTM - Prior to v4....

PT-2024-4170

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4-p8 and earlier Adobe Commerce versions 2.4.5-p7 and earlier Adobe Commerce versions 2.4.6-p5 and earlier Adobe Commerce versions 2.4.7 and earlier Description Adobe Commerce and Magento Open Source are affected by...

Zend-JSON vulnerable to XXE/XEE attacks

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity XXE Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTY...

Zendframework Denial of Service vector via XEE injection

ZendDom, ZendFeed, ZendSoap, and ZendXmlRpc are vulnerable to XML Entity Expansion XEE vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memo...

GHSA-2JX7-XG83-J2M7 Zendframework Denial of Service vector via XEE injection

ZendDom, ZendFeed, ZendSoap, and ZendXmlRpc are vulnerable to XML Entity Expansion XEE vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memo...

ebookmeta XML External Entity vulnerability

An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service DoS via crafted XML input...

GHSA-HX54-PF28-7XCH ebookmeta XML External Entity vulnerability

An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function via lxml dependency allows attackers to access sensitive information or cause a Denial of Service DoS via crafted XML input...

GHSA-WHF4-FPJ8-PGG8 ebookmeta XML External Entity vulnerability

An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service DoS via crafted XML input...

ebookmeta XML External Entity vulnerability

An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function via lxml dependency allows attackers to access sensitive information or cause a Denial of Service DoS via crafted XML input...

GHSA-MHPX-3RV8-WRJM ZendFramework potential XML eXternal Entity injection vectors

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity XXE Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTY...

GHSA-4J9X-G4X8-VCMF ZendFramework potential XML eXternal Entity injection vectors

ZendFeedRss and ZendFeedAtom were found to contain potential XML eXternal Entity XXE vectors due to insecure usage of PHP's DOM extension. External entities could be specified by adding a specific DOCTYPE element to feeds; exploiting this vulnerability could coerce opening arbitrary files and/or...