18884 matches found
CVE-2023-50380 Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server
XML External Entity injection in apache ambari versions = 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The...
CVE-2023-50380 Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server
XML External Entity injection in apache ambari versions = 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The...
CVE-2023-50380 Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server
XML External Entity injection in apache ambari versions = 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The...
Attacks, Vulnerabilities and Actors 19 to 25 February 2024
For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, a total of fifteen attacks were executed, five vulnerabilities were uncovered, and five active adversaries...
SUSE CVE-2023-52461
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed entity in drmschedentityinit--shouldn't happen, but we verify--with out-of-bounds priority value, we set it to an allowed value. Fix the...
PT-2024-4520 · Apache · Apache Ambari
Name of the Vulnerable Software and Affected Versions: Apache Ambari versions = 2.7.7 Description: The issue is related to an XML External Entity XXE injection attack in the Oozie Workflow Scheduler component of Apache Ambari. This vulnerability is caused by a lack of proper user input validation...
The vulnerability of the Spreadsheet::ParseXLSX library for the Perl programming language arises from incorrect restrictions on XML references to external objects. This allows attackers to perform XXE attacks.
The vulnerability of the Spreadsheet::ParseXLSX library for the Perl programming language relates to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks using a specially created XLSX file...
Fedora 39 : mingw-expat (2024-fbe1f0c1aa)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fbe1f0c1aa advisory. Update to 2.6.0, fixes CVE-2023-52425, CVE-2023-52426. Tenable has extracted the preceding description block directly from the Fedora security...
UBUNTU-CVE-2023-52461
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed entity in drmschedentityinit--shouldn't happen, but we verify--with out-of-bounds priority value, we set it to an allowed value. Fix the...
Design/Logic Flaw
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed entity in drmschedentityinit--shouldn't happen, but we verify--with out-of-bounds priority value, we set it to an allowed value. Fix the...
CVE-2023-52461 drm/sched: Fix bounds limiting when given a malformed entity
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed entity in drmschedentityinit--shouldn't happen, but we verify--with out-of-bounds priority value, we set it to an allowed value. Fix the...
CVE-2023-52461 drm/sched: Fix bounds limiting when given a malformed entity
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed entity in drmschedentityinit--shouldn't happen, but we verify--with out-of-bounds priority value, we set it to an allowed value. Fix the...
CVE-2023-52461
CVE-2023-52461 affects the Linux kernel DRM scheduler component (drm/sched). A malformed drm_sched_entity_init() could cause an out-of-bounds priority value to be clamped incorrectly due to a flawed bound-setting expression; this has been fixed. The vulnerability is categorized with locally explo...
CVE-2023-52461
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed entity in drmschedentityinit--shouldn't happen, but we verify--with out-of-bounds priority value, we set it to an allowed value. Fix the...
CVE-2023-52461
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed entity in drmschedentityinit--shouldn't happen, but we verify--with out-of-bounds priority value, we set it to an allowed value. Fix the...
CVE-2024-25129 Limited data exfiltration in CodeQL CLI
The CodeQL CLI repo holds binaries for the CodeQL command line interface CLI. Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various auxiliary files is vulnerable to an XML External Entity attack. If a vulnerable version of the CLI is used to process either a maliciously...
PT-2024-20768 · Unknown · Codeql Cli
Name of the Vulnerable Software and Affected Versions: CodeQL CLI versions prior to 2.16.3 Description: The CodeQL CLI is vulnerable to an XML External Entity attack due to an XML parser used to read auxiliary files. This vulnerability can be exploited when processing maliciously modified CodeQL...
XML External Entity (XXE)
liferay portal vulnerable to XML External Entity XXE. The vulnerability is due toJava2WsddTask.format method, which allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources...
MAL-2024-1032 Malicious code in testconfusiontestt (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68716301fda6917d0a2abf5455e1ab2d5780d533eb27a1033a84888b0f9677eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...