Xxe

FD Application Apr. 2022 Edition Version 9.01 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker...

CVE-2023-42132

FD Application Apr. 2022 Edition Version 9.01 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker...

CVE-2023-42132

FD Application Apr. 2022 Edition Version 9.01 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker...

Improper restriction of XML external entity references (XXE) in FD Application

Overview FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references XXE CWE-611. Toyama Taku and Sakaki Ryutaro of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...

FD Application Code Issue Vulnerability

FD Application is an application software from FD. A code issue vulnerability exists in FD Application Apr. 2022 Edition 9.01 and prior versions that stems from improperly restricting XML External Entity References XXE, which could allow an attacker to read arbitrary files on the system by...

PT-2023-28280 · Unknown · Application

Name of the Vulnerable Software and Affected Versions: FD Application versions 9.01 and earlier Description: The issue improperly restricts XML external entity references XXE, allowing an attacker to read arbitrary files on the system by processing a specially crafted XML file. Recommendations: F...

MAL-2023-8258 Malicious code in starcoffe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21d2d2d622bacbbb48186877f4de201e3ef7466ac586b34502e7df3b1dfc5e37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2023-1695834624 python3: Fix of 2 CVEs

CVE-2021-3177: Replace snprintf to prevent buffer overflow - CVE-2022-48565: Reject XML entity declarations in plist files...

Entity cache - Critical - Information disclosure - SA-CONTRIB-2023-046

Entity Cache puts core entities into Drupal's cache API. A recent release of the module does not sanitize certain inputs appropriately. This can lead to unintended behavior when wildcard characters are included in the input. The impact of this bug should be relatively minor in most configurations...

MAL-2023-8245 Malicious code in arcotest2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 078ddfad78f2c5ca9ae82c040a4a51c180fedd8116e46f32a6a6fcdff2e8561d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8244 Malicious code in arcotest1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 729c32fc154769efa0f919edac30e00d9e8a63dc05f166d3a156924f939750f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8250 Malicious code in fca-priyansh3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd0e5c080a7eaaffbca2eaab0a8d833f9f08cb3b4a122235e6d1c61adb46a0d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8253 Malicious code in thinh2001-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9f8d03b386fe1014644e4170699db11a1fccd1cec5639a5e99ac272d9fd12c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Multiple vulnerabilities in Apache Camel core affect IBM Application Performance Management products

Summary Apache Camel core is used by IBM Application Performance Management. The vulnerabilities in the product component have been addressed. Vulnerability Details CVEID:CVE-2014-0002 DESCRIPTION: Apache Camel could allow a remote attacker to obtain sensitive information, caused by an error in t...

MAL-2023-8228 Malicious code in beta-fhr-nxt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d17d64e039783ffdcb641aab3eea7afee429e6a2b80ebb2556f96d8951beb39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8236 Malicious code in fca-rqzax-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ecedbb47457d84a3321523d3e9df1d860170b1c57af2d4fb6b5faf7f89b742a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8235 Malicious code in fca-manhdz2004 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3c18d4b3f99dcbaff3772644af19fb0cc292ab9ad541543f04450e83d004188 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8233 Malicious code in fca-bot-asuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a11398483bdb1e63dc33177aba0b472a6fba5ea548f7e7bea526beb89f23551 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8230 Malicious code in chat-api-asuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85f583cda7182f56d351d1ce81779546a87791f7686b5acf9ae3d1e80250e9a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to XML external entity XXE due to Apache Ivy

Summary Apache Ivy may be used by plugins or custom scripts in IBM UrbanCode Deploy UCD. Apache Ivy is vulnerable to a XXE caused by improper handling of XML external entity XXE declarations by the XML parser. CVE-2022-46751 Vulnerability Details CVEID:CVE-2022-46751 DESCRIPTION: Apache Ivy could...