MAL-2023-8236 Malicious code in fca-rqzax-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ecedbb47457d84a3321523d3e9df1d860170b1c57af2d4fb6b5faf7f89b742a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8235 Malicious code in fca-manhdz2004 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3c18d4b3f99dcbaff3772644af19fb0cc292ab9ad541543f04450e83d004188 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8233 Malicious code in fca-bot-asuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a11398483bdb1e63dc33177aba0b472a6fba5ea548f7e7bea526beb89f23551 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8230 Malicious code in chat-api-asuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85f583cda7182f56d351d1ce81779546a87791f7686b5acf9ae3d1e80250e9a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to XML external entity XXE due to Apache Ivy

Summary Apache Ivy may be used by plugins or custom scripts in IBM UrbanCode Deploy UCD. Apache Ivy is vulnerable to a XXE caused by improper handling of XML external entity XXE declarations by the XML parser. CVE-2022-46751 Vulnerability Details CVEID:CVE-2022-46751 DESCRIPTION: Apache Ivy could...

The vulnerability of the IoT device management software Eclipse Leshan, related to incorrect restrictions on XML references to external objects, allows attackers to execute XXE attacks.

The vulnerability of the IoT device management software Eclipse Leshan is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a remote attacker to execute an XXE attack...

CVE-2023-38343

An XXE XML external entity injection vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery...

MAL-2023-8201 Malicious code in @zettle-bo/pp-profile-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1620f673435e4da925d2327f2d50d0ab0b66532cdb1d19d87accae90da85ac3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8212 Malicious code in @zettle-bo/vertical-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29df8a3283a276676a3afb1f56cc288ff4ceceb1d591ec934732ccdc9d109cad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8198 Malicious code in @zettle-bo/integrations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f1d37dda5bbd9abe0b6406a408e4cc6d849f90c1602e3455ce8de0b9fc50fa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8205 Malicious code in @zettle-bo/react-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 476ca9163b9976a64e9b1596fb739c8dc2c4725cd2f321d998e6da3cf072e3ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8213 Malicious code in sentrybrowser5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd057b6a781a16b9ccd0cbb9960c5fef29f51b3587235e4cfa30fe7318958169 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Debian: Security Advisory (DLA-3575-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-38343

CVE-2023-38343 describes an XXE vulnerability in the CSEP component of Ivanti Endpoint Manager prior to 2022 SU4. External entity references are enabled in the XML parser, enabling potential file disclosure and SSRF. CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); attack vector is ...

CVE-2023-38343

An XXE XML external entity injection vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery...

Ivanti Endpoint Manager Code Issue Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager versions prior to 2022 SU4, which stems from the presence of XML External Entity Injection in the CSEP component, where external entity...

XXE (XML External Entity Injection) in Jira Service Management Data Center and Server - CVE-2019-13990

h2. Summary of Vulnerability Certain versions of Jira Service Management Server & Data Center were affected by CVE-2019-13990. The affected versions contained vulnerable versions of Terracotta Quartz Scheduler which allowed authenticated attackers to initiate an XML External Entity injection atta...

MAL-2023-8187 Malicious code in scoot-layout-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a09230af6397fced3ca15612fad365e70e995e8a83c26af0004b8e1fd8000e02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8186 Malicious code in dot-environment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c351e2b7cce60d59efcaf6f8cf5b03d221b55f5c48e2d6ea02bd18a1868cdb7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE SLES15 Security Update : release-notes-susemanager, release-notes-susemanager-proxy (SUSE-SU-2022:3761-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3761-1 advisory. Release notes for SUSE Manager: - Update to SUSE Manager 4.3.2 Containerized proxy and RBS are now fully supported HTTP API is now fully...