XML Entity Expansion

libexpat is vulnerable to XML Entity Expansion . the vulnerability is due to Improper Restriction of Recursive Entity References in DTDs if XMLDTD is undefined at compile time...

Exploit for Improper Restriction of XML External Entity Reference in Ivanti Connect_Secure

CVE-2024-22024 Check for CVE-2024-22024 vulnerability in Ivant...

MAL-2024-985 Malicious code in iris-front-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ed1b8ea683be3ab1a06938511d841bfbd293b36b9a8bcccedd6d794a2af3f85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

...

Huawei EulerOS: Security Advisory for libplist (EulerOS-SA-2024-1147)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerability fixed in Ivanti Connect Secure and Policy Secure Gateways

Ivanti has fixed a vulnerability in Ivanti Connect Secure, Policy Secure and ZTA gateway. The vulnerability allows a malicious party to use an XML External Entity attack to gain access to system resources without having the required authentication. The vulnerability was discovered during the...

CVE-2024-22024 (XXE) for Ivanti Connect Secure and Ivanti Policy Secure

Executive Summary: As part of the ongoing investigation, we discovered a new vulnerability as part of our internal review and testing of our code, which was also responsibly disclosed by watchTowr. This vulnerability only affects a limited number of supported versions – Ivanti Connect Secure...

EulerOS 2.0 SP5 : python (EulerOS-SA-2024-1160)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A use-after-free exists in Python through 3.9 via heappushpop in heapq. CVE-2022-48560 - An XML External Entity XXE issue was discovered in Pyth...

CentOS 8 : libxml2 (CESA-2023:0173)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:0173 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several...

apache-ivy: XML External Entity vulnerability

Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy...

Slackware Linux 15.0 / current expat Multiple Vulnerabilities (SSA:2024-038-01)

The version of expat installed on the remote host is prior to 2.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-038-01 advisory. - libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case...

Directory Traversal: Examples, Testing, and Prevention

Unveiling the Enigma of Path Navigation: An Exhaustive Exploration and Insight Path Navigation, often referred to as Folder Navigation, symbolizes a kind of security extraction point allowing unauthorized individuals to gain unauthorized access to specific files held within a server's database...

CVE-2023-52239

The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport...

SUSE CVE-2023-52426

libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...

CVE-2023-52426

A flaw was found in Expat libexpat. If XMLDTD is undefined at compile time, a recursive XML Entity Expansion condition can be triggered. This issue may lead to a condition where data is expanded exponentially, which will quickly consume system resources and cause a denial of service. Mitigation...

PT-2024-14500 · Magic · Magic Xpi Integration Platform

Name of the Vulnerable Software and Affected Versions: Magic xpi Integration Platform version 4.13.4 Description: The XML parser in Magic xpi Integration Platform allows XXE attacks, for example, via onItemImport. Recommendations: For Magic xpi Integration Platform version 4.13.4, consider...

VulnCheck KEV: CVE-2024-22024

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...

Magic xpi Integration Platform Security Vulnerability

Magic xpi Integration Platform is an integration platform from Magic designed to simplify integration between enterprise applications and systems. A security vulnerability exists in Magic xpi Integration Platform version 4.13.4. An attacker exploited the vulnerability to perform an xml external...

MAL-2024-965 Malicious code in ngpd-merceros-ui-meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b9c719bf14b04e4b0155b8641b63f83c3a854798e6f3038be2d9f6d25e73c3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-966 Malicious code in ngpd-merceros-ui-widget-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc889355fb898bd26e3457c596dcb5cac12554f84b9b1e98741c4e706b8b7b8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...