PT-2024-19043

Name of the Vulnerable Software and Affected Versions Electronic Delivery Check System Doboku versions 18.1.0 and earlier Electronic Delivery Check System Dentsu versions 12.1.0 and earlier Electronic Delivery Check System Kikai versions 10.1.0 and earlier Electronic delivery item Inspection...

JVN#40049211: Improper restriction of XML external entity references (XXE) in Electronic Deliverables Creation Support Tool provided by Ministry of Defense

Electronic Deliverables Creation Support Tool provided by Ministry of Defense improperly restricts XML external entity references XXE CWE-611. Impact Processing a specially crafted XML file may lead to exposure of internal files on the system. Solution Update the Software Update the software to t...

VulnCheck KEV: CVE-2020-24589

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection XXE attacks...

VulnCheck KEV: CVE-2021-27931

LumisXP aka Lumis Experience Platform before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service...

HPESBGN04569 rev.1 - HPE Unified Mediation Bus (UMB), Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Sensitive Information, URL Redirection, Unauthenticated Arbitrary Code Execution, Unauthorized Write Access to the File System, memory corruption, XML External Entity XXE, Host Header Injection; Remote: Bypass Security...

GLSA-202401-26 : Apache XML-RPC: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202401-26 Apache XML-RPC: Multiple Vulnerabilities - XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forger...

MAL-2024-144 Malicious code in syxx.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a18f7717b2f393a788bf573c56118af761b8ee733a33a527a4fdb428d339934 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2024-1080 python-fonttools security update

FontTools is a library for manipulating fonts, written in Python. The project includes the TTX tool, that can convert TrueType and OpenType fonts to and from an XML text format, which is also called TTX. It supports TrueType, OpenType, AFM and to an extent Type 1 and some Mac-specific formats. Th...

DEBIAN-CVE-2024-23525

The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the noxxe option of XML::Twig...

UBUNTU-CVE-2024-23525

The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the noxxe option of XML::Twig...

Security Bulletin: IBM Maximo Manage is vulnerable to attack due to Eclipse Jetty ( IBM X-Force ID 261776)

Summary IBM Maximo Manage is vulnerable to attack due to Eclipse Jetty IBM X-Force ID 261776 Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. ...

MAL-2024-123 Malicious code in discord.js-v12selfbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 185d6410de1e975280bd6d535f7905cd9264eacb3c2ff98813e61d1a4ae0e2b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord.js-selfbot-vl3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93b8a4d4a43d4cc9677b980b29b0c52f7767b770407fc60503959d4b1c585ca1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-127 Malicious code in noleakdmall (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2bc9f62148f8417bf5be1b0b2bc56a7f279b99ab37d5cf7a9c3594278020fe6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-113 Malicious code in child-proces (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c848180a34155de4ca426e1b0fb5f5d6438c46d1f8c55e8af1a6ddd2bd50078b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-117 Malicious code in discord.js-lock-selfbot-v13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b6ced52518f96ad1ced4f124d86601328e2898f7c62f1f619f33a4f0f202a7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Spreadsheet::ParseXLSX Security Vulnerability

Spreadsheet::ParseXLSX is an XLSX file parser. A security vulnerability exists in Spreadsheet::ParseXLSX versions prior to 0.30 that stems from allowing XML External Entity References XXE attacks...

Security Bulletin: IBM Maximo Asset Management is vulnerable to attack due to Eclipse Jetty ( IBM X-Force ID 261776)

Summary IBM Maximo Asset Management is vulnerable to attack due to Eclipse Jetty IBM X-Force ID 261776 Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the...

MAL-2024-107 Malicious code in djs13-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5aeb852fd37db4368a6b873b7a177bb29a5b995b6bf31738e8d8a691ed9706f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-104 Malicious code in chalk-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b0f69a9a955c3d91a271b9915114fbf4c8fa069f6358c794b9a27ab30c2df84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...