CVE-2023-49733

CVE-2023-49733 affects Apache Cocoon 2.2.0 up to versions before 2.3.0. It is an XML External Entity (XXE) reference vulnerability due to improper restriction, enabling potentially sensitive data exposure and other impacts as described in the sources. The recommended remediations are upgrading to...

MAL-2023-8643 Malicious code in coloureds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3f381cffa410c14f42e50fcebd0f587b105b4756f34b5a05912f38b84fdc798 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apache Tiles Path Traversal Vulnerability

Apache Tiles is a page layout framework for JavaEE applications from the Apache Foundation. A path traversal vulnerability exists in Apache Tiles prior to version 2.0.0, which stems from failing to validate the value of the DefaultLocaleResolver.LOCALEKEY attribute set on a session when parsing a...

PT-2023-31312 · Apache · Apache Cocoon

Name of the Vulnerable Software and Affected Versions: Apache Cocoon versions 2.2.0 through 2.2.x before 2.3.0 Apache Cocoon version 2.2.0 Description: The issue is related to an Improper Restriction of XML External Entity Reference, which allows users to inject malicious code into XML documents...

Apache Cocoon 代码问题漏洞

Apache Cocoon is the United States Apache Apache Foundation of a component-based Web development concepts built Web application framework. Apache Cocoon suffers from an XML External Entity Injection vulnerability that arises from a network system or product that does not have the correct filters ...

PT-2023-31314 · Apache +1 · Apache Tiles +1

Name of the Vulnerable Software and Affected Versions: Apache Tiles versions 2 onwards Description: The issue arises from the lack of validation of the value set as the DefaultLocaleResolver.LOCALE KEY attribute on the session while resolving XML definition files. This can lead to possible path...

Jenkins MATLAB Plugin XML External Entity vulnerability

Jenkins MATLAB Plugin determines whether a user-specified directory on the Jenkins controller is the location of a MATLAB installation by parsing an XML file in that directory. MATLAB Plugin 2.11.0 and earlier does not perform permission checks in several HTTP endpoints implementing related form...

CVE-2023-49656

Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Xxe

Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

MAL-2023-8632 Malicious code in @lognex/services-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bffc36961ebbc0c14cde7de119a760020e401111ed84f570e3473f12d23557a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8630 Malicious code in @lognex/ecom-recommendations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0ab65eb1c1e53ad84ab09e9426d718197e6137500c81a66639f4e4249e39edb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8631 Malicious code in @lognex/notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa9236ea5d072a10fa7e7acc48f2a65e85f8ad6cc9edd1158828a3ff4db63ba6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jenkins MATLAB Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-31281 · Jenkins · Jenkins Matlab Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MATLAB Plugin versions 2.11.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to have Jenkins parse an XML file from the Jenkins controller file system. The plugin determines whether a...

PT-2023-31280 · Jenkins · Jenkins Matlab Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MATLAB Plugin versions 2.11.0 and earlier Description: The issue arises from missing permission checks in the Jenkins MATLAB Plugin, allowing attackers to have Jenkins parse an XML file from the Jenkins controller file system...

Design/Logic Flaw

The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes...

MAL-2023-8619 Malicious code in oddsfire-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6560345fe7b94e452865d383a96b49b27e71c7113505ddfd5306218da9648d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8612 Malicious code in minotari_wallet_ff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48f015d501f7fda235545da39cb174ad6dfd4de2416ecb639a39644fd44618b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to server-side request forgery due to Eclipse Jetty (261776)

Summary IBM Sterling Connect:Direct Browser User Interface uses Eclipse Jetty server. Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. By...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to server-side request forgery due to Eclipse Jetty (261776)

Summary IBM Sterling Connect:Direct Web Services uses Eclipse Jetty. Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. By sending a specially...