CLSA-2023-1696878189 python: Fix of CVE-2022-48565

CVE-2022-48565: Reject XML entity declarations in plist files...

CLSA-2023-1696878020 python: Fix of CVE-2022-48565

CVE-2022-48565: Reject XML entity declarations in plist files...

CLSA-2023-1696877835 python: Fix of CVE-2022-48565

CVE-2022-48565: Reject XML entity declarations in plist files...

CLSA-2023-1696877712 expat: Fix of 2 CVEs

CVE-2022-23990: lib: prevent integer overflow in function doProlog - CVE-2022-43680: fix overeager DTD destruction in XMLExternalEntityParserCreate...

MAL-2023-8315 Malicious code in emob-lp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c69ecc160f72c29544fec3ce637a39a70d5d458f1e42487180d41443154116f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

JetBrains Ktor Code Issue Vulnerability

JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A code issue vulnerability exists in JetBrains Ktor versions prior to 2.3.5 that stems from an XML External Entity Injection XXE vulnerability in the default configuration of ContentNegotiation...

SUSE SLED12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2023:4001-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4001-1 advisory. - CVE-2022-48566: Constant-time-defeating optimisations were possible in the accumulator variable in...

CVE-2023-42445 Possible local file exfiltration by XML External entity injection

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack OOB-XXE, just parsing XML can lead to exfiltration of local tex...

CVE-2023-42445 Possible local file exfiltration by XML External entity injection

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack OOB-XXE, just parsing XML can lead to exfiltration of local tex...

CLSA-2023-1696537106 libxml2: Fix of 5 CVEs

CVE-2021-3517: fix flaw in the xml entity encoding - CVE-2021-3518: fix dangling pointers in entity reference nodes - CVE-2022-23308: fix use-after-free of ID and IDREF attributes - CVE-2022-40303: fix integer counters overflow when parsing a multi-gigabyte XML - CVE-2022-40304: fix double free...

Guyana Governmental Entity Hit by DinodasRAT in Cyber Espionage Attack

A governmental entity in Guyana has been targeted as part of a cyber espionage campaign dubbed Operation Jacana. The activity, which was detected by ESET in February 2023, entailed a spear-phishing attack that led to the deployment of a hitherto undocumented implant written in C++ called...

Exploit for Improper Restriction of XML External Entity Reference in Dogtagpki

CVE-2022-2414 CVE-2022-24...

Exploit for Improper Restriction of XML External Entity Reference in Dogtagpki

CVE-2022-2414 CVE-2022-24...

apache-ivy: XML External Entity vulnerability

Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy...

Security Bulletin: OpenSource Apache Taglibs Vulnerability affects IBM Jazz Reporting Service (CVE-2015-0254)

Summary Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID:CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to...

Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing is vulnerable to a remote attack due to Apache Jena Core

Summary BM Engineering Lifecycle Optimization - Publishing is vulnerable to a remote attack due to Apache Jena Core Vulnerability Details CVEID:CVE-2021-39239 DESCRIPTION: Apache Jena could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity...

Security Bulletin: IBM Jazz Reporting Service is vulnerable to XML external entity (XXE) attacks due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0 (CVE-2021-39239)

Summary IBM Jazz Reporting Service is vulnerable to CVE-2021-39239 due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0. Apache Jena is used by IBM Jazz Reporting Service for working with RDF models. The fix disables external entity processing in calls made to the...

(0Day) D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the addDv7Probe function. Due to the improper restriction of XML External Entity X...

PT-2023-6102 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View versions affected versions not specified Description: The issue is related to the addDv7Probe function and involves improper restriction of XML External Entity XXE references. This allows remote attackers to disclose sensitive...

MAL-2023-8280 Malicious code in @badolkhan420/fca-badol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 436ac692985a2fae4a79ec7010810f6a2b4d617ea932fab96f222989b578f74b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...