CVE-2023-4218 XXE in eclipse.platform / Eclipse IDE

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

Eclipse IDE code problem vulnerability

Eclipse IDE is a cross-platform open source integrated development environment from the Eclipse Foundation of Canada. A security vulnerability exists in versions of Eclipse IDE prior to 2023-09 4.29, which stems from the fact that certain files containing xml content are susceptible to a variety ...

PT-2023-28286 · Eclipse +2 · Eclipse Ide +2

Name of the Vulnerable Software and Affected Versions: Eclipse IDE versions prior to 2023-09 4.29 Description: The issue concerns the parsing of XML content in certain files, making them vulnerable to XXE attacks. This can occur when a user opens a malicious project or updates an open project wit...

DRUPAL-CONTRIB-2023-050

This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately verify whether a given user has the necessary permissions to access an entity's label creating an access bypass vulnerability. This vulnerability is mitigated by the fact that enti...

GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2023-050

This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately verify whether a given user has the necessary permissions to access an entity's label creating an access bypass vulnerability. This vulnerability is mitigated by the fact that enti...

MAL-2023-8479 Malicious code in rb-seatlayout-canvas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab7073e8386662ab584a412e7d011050e505dea8df14c0e5273606bf0a823ae1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Rocky Linux 8 : qt5-qtbase and qt5-qtwebsockets (RLSA-2020:4690)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4690 advisory. - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue t...

RHEL 9 : qt5 (RHSA-2023:6369)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6369 advisory. Qt is a software toolkit for developing applications. Security Fixes: qt: buffer over-read via a crafted reply from a DNS server...

Fedora 39 : python2.7 (2023-ea38857cc3)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ea38857cc3 advisory. Security fix for CVE-2022-48565. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

SUSE: Security Advisory (SUSE-SU-2023:4367-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rocky Linux 9 : libxml2 (RLSA-2023:0338)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0338 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several...

Rocky Linux 8 : prometheus-jmx-exporter (RLSA-2020:4807)

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2020:4807 advisory. - The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. CVE-2017-18640 Note that Nessus h...

MAL-2023-8445 Malicious code in @inventashif/workspace-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fe4fedd5d11a10d847f74fc3fa803fcacb0f7484be032ee6b87bdb61e84ed31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in share-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba664ab24090b0fcbea9d3c7c58134f47472535eba4ff9d4a65946aa5efad8ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8462 Malicious code in print-vault-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 367bf013409840485fdaebde8da15293906ece37c6c79fd8b03396935ac7a2a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ksm-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acbd11805012facf9e6ace839d7003088cf99552b9da073484d17920f72c5d9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8457 Malicious code in fa-icdc-form-api-bdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24842401e160323f0909c7f6e561fbaa5cbdb6f3b5e3c0dfe2a4dd0fe1877e5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8452 Malicious code in bt8-wax-front-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94edc2702431bf0ca422456566133b260f48b21d456989d157837fbf5e4d80ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8448 Malicious code in airslate-error-handling-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4e66e5d16011fdd608b4f1f9fbeec95335036b7ba46f4446b4732747e1870e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML External Entity Injection

OpenCRX is vulnerable to XML External Entity injection XXE. The vulnerability is due to improper input sanitization in the DocumentBuilderFactory function . This can potentially lead to server side request forgery attacks...