Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM WebSphere Application Server traditional is vulnerable to an XML External Entity (XXE) Injection vulnerability - CVE-2023-27554

Summary IBM WebSphere Application Server is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Following IBM® Engineering Lifecycle Engineering product ...

MAL-2023-1041 Malicious code in vue-router-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d2eb48e80ee684a1f36a9d44f562d8f86ed9df08286f57fdee187de71bf7010 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1035 Malicious code in flot-axis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75e800a2dadaa8f5d0ac8a5db1564e97a702c66176c2da0c537191d88cf8fc81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-hrz-reup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0ffd60e2bdab5d1a78415bd3e9e825324abd5389b013ffabaaac77f4789ad54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1039 Malicious code in storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44e2fc216a94eece7f4dff23344c885f24361cb497ae18d6c7dde8ba3c4d39a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1032 Malicious code in eslint-config-scp-custom-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73a0feb02dac8e9a44d4dfef753d5e64e20660b0f07333ca0660f422036d468d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-6139 · Raspap · Raspap

Name of the Vulnerable Software and Affected Versions: RaspAP versions 2.8.0 through 2.9.2 Description: The issue is related to a command injection vulnerability. It allows an authenticated attacker to execute arbitrary OS commands as root via the entity POST parameters in the /ajax/networking/ge...

RaspAP Command Injection Vulnerability

RaspAP is a simple wireless AP setup and management for Debian-based devices. A security vulnerability exists in RaspAP versions 2.8.0 through 2.9.2 that stems from the presence of a command injection vulnerability. Allows an attacker to execute arbitrary commands as root via the POST parameter...

An issue was discovered in Qt before 5.15.15 6.x before 6.2.10 and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.

...

MAL-2023-1023 Malicious code in test-hacker-sharma (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e719660cef7a5f238345da6413201c023f88d40596fc85983cf0489e0d68fb9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-toolbox-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 422a604d191acbb8c624bc1ef790995e034a891c2bb65d4fdf729675ed8d4ae6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1019 Malicious code in rhancis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc33fb78ec5c895246ba386fed24b5d490e42c1679729f9fc95c8d004b397b4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-rhancis-pogi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3398b30916ed54737b0f733b7dc0b100065a9059a19ffc24e45ad9690d6d85a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1042 Malicious code in yatai-web-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f548d205122fcfcec01de022463ec287546b7367481a1ec5adb29294e452b8f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-480 Malicious code in grabathon-v8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45c5d3c773c46d98a52b454f0e11ea84a072863fc1133b5012841efcc9739162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-766 Malicious code in seaport-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7c3daf7c2577a44884df2696c8fc7fbc4329e375acf9565ddb84ee007686ec2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-541 Malicious code in js-node-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b096038aa13ffe408e446c95499cf94a514d9231887e564f8ddd667f99e0ecf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-935 Malicious code in very-bad-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2289bce399400ee41a568ffb19da6c2728513c5f5a8e3f818532bb7b4978d8ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-ivancotacte1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68b9dd7142d0fb0d52f6afd89beeb1f1ab065b4d13efeff8d7f032862f9f7f13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-38490 Kirby XML External Entity (XXE) vulnerability in the XML data handler

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the Xml data handler e.g. Data::decode$string, 'xml' or the Xml::parse method in site or plugin code. The Kirby core does not use any of the...