18892 matches found
CVE-2023-46802
e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references XXE due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker...
PT-2023-30228 · E-Tax · E-Tax
Name of the Vulnerable Software and Affected Versions: e-Tax software versions 3.0.10 and earlier Description: The issue is related to the improper restriction of XML external entity references XXE in the e-Tax software due to the configuration of the embedded XML parser. This allows an attacker ...
Malicious code in watchman-search-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9d31c46bc906a3eeb18b4852518f529d915f87ab7935775541759d38c18151e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Amazon Linux AMI : python27 (ALAS-2023-1880)
The version of python27 installed on the remote host is prior to 2.7.18-2.149. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1880 advisory. An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity...
e-Tax Reception System Security Vulnerability
The e-Tax Reception System is an electronic tax management system organized by the National Tax Agency NTA of Japan. A security vulnerability exists in e-Tax Reception System version 3.0.10 and earlier, which stems from an improper restriction of XML External Entity References XXE, where processi...
MAL-2023-8418 Malicious code in demo-saas (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7346c8d2670e05b376c36a799aafbe36cad56e319900ab63a766fea56e0985cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Important: python
Issue Overview: An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. CVE-2022-48565 Affected Packages: python Note: This advisory is applicable to Amazon Linux 2 AL2 Core...
Security Bulletin: IBM Financial Transaction Manager v3.2.x is vulnerable to XML External Entity Injection (XXE)
Summary An XML External Entity Injection XXE vulnerability in Java based XML parsers within IBM Financial Transaction Manager was addressed. Vulnerability Details CVEID:CVE-2023-35892 DESCRIPTION: IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity...
SUSE CVE-2015-9541
Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564...
CVE-2022-34832
An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component...
CVE-2022-34832
An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component...
VERMEG Agile Reporter Security Breach
VERMEG Agile Reporter is a hybrid of pre-packaged modules from VERMEG. A security vulnerability exists in VERMEG Agile Reporter version 21.3, which stems from an XML document via the Analysis component that can cause XML External Entity Injection XXE...
SUSE SLES15: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2023:4220-1)
The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4220-1 advisory. - CVE-2022-48566: Fixed a potential timing side channel due to inadequate checking during HMAC comparison bsc1214691. Tenable has...
What is User and Entity Behavior Analytics (UEBA) ?
As the digital world continually transforms at a rapid pace, the necessity for high-grade, reliable safety controls becomes even more crucial. Among a pool of security tactics and tools, User and Entity Behavior Analytics UEBA rises as a formidable measure to shield digital commodities. This...
Important: python3
Issue Overview: A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The...
Withdrawn Advisory: dom4j XML Entity Expansion vulnerability
Withdrawn Advisory This advisory has been withdrawn because the underlying vulnerability could not be reproduced. This link is maintained to preserve external references. Original Description An issue in dom4.j org.dom4.io.SAXReader v.2.1.4 and before allows a remote attacker to obtain sensitive...
MAL-2023-8400 Malicious code in envi-conf (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf29d35387a88f70fb474d1d02435edd91ab0c4f8f482414b8f2c046328b820f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Improper restriction of XML external entity reference (XXE) vulnerability in OMRON CX-Designer
Overview CX-Designer provided by OMRON Corporation contains an improper restriction of XML external entity reference XXE vulnerability CWE-611. Michael Heinzl reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact If a user opens a specially crafted project fil...
Important: apache-ivy
Issue Overview: Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own...
