MAL-2023-755 Malicious code in sample-app-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a7432b767dd8bf532a686b3a40add828170682af3dcfdcab09c7d7a012a83e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-22282 · Unknown · Frenic Rhc Loader

Name of the Vulnerable Software and Affected Versions: FRENIC RHC Loader versions 1.1.0.3 and earlier Description: An issue exists due to improper restriction of XML external entity reference XXE, which may lead to the disclosure of sensitive information on the system where the affected product i...

CVE-2023-24470

Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0...

PT-2023-19627 · Micro Focus · Arcsight Logger

Name of the Vulnerable Software and Affected Versions: ArcSight Logger versions prior to 7.3.0 Description: The issue is related to a Potential XML External Entity Injection. Recommendations: For versions prior to 7.3.0, update to version 7.3.0 or later to resolve the issue...

CVE-2023-24470

ArcSight Logger prior to version 7.3.0 is vulnerable to XML External Entity (XXE) injection (CVE-2023-24470). The root cause is XXE in the product’s XML processing, enabling an attacker to potentially access or exfiltrate data via crafted XML. Public advisories confirm fixes in ArcSight Logger 7....

MAL-2023-304 Malicious code in elliptic-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0ffc8361769988057a4d6c1f79b5cdcf930ac38ce3f5243cd2af71837be266c1 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

CVE-2023-29498

Improper restriction of XML external entity reference XXE vulnerability exists in FRENIC RHC Loader v1.1.0.3 and earlier. If a user opens a specially crafted project file, sensitive information on the system where the affected product is installed may be disclosed...

Micro Focus ArcSight Logger 代码问题漏洞

Micro Focus ArcSight Logger is a suite of log management software from Micro Focus UK. The software collects and integrates data from any log generation source for log management, searching, indexing, reporting, analyzing and retention. A security vulnerability exists in Micro Focus ArcSight Logg...

CVE-2023-24470

Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0...

Fuji Electric FRENIC RHC Loader XML External Entity Reference Vulnerability

Fuji Electric FRENIC RHC Loader is a software tool developed by Fuji Electric Japan for debugging and monitoring inverters, mainly serving the industrial automation field. The Fuji Electric FRENIC RHC Loader suffers from an XML external entity reference vulnerability that can be exploited by an...

Medium: xmlrpc

Issue Overview: XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery SSRF attacks via a crafted DTD. CVE-2016-5002 Affected Packages: xmlrpc Note: This advisory is...

Huawei EulerOS: Security Advisory for pki-core (EulerOS-SA-2023-2197)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2023-260 Malicious code in discount-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b62bcefcaea2db2548388a227a4b29129aec31ac8138d04b9763fbd8e5bb54ac Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

Huawei EulerOS: Security Advisory for pki-core (EulerOS-SA-2023-2164)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Regular Expression Denial Of Service (ReDoS)

fast-xml-parser is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in the readDocType function at DocTypeReader.js which allows an attacker to cause an application crash by submitting an entity name with bad preforming regex because entity names are not sanitize...

SUSE CVE-2023-34104

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

EulerOS 2.0 SP8 : pki-core (EulerOS-SA-2023-2197)

According to the versions of the pki-core package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to...

CVE-2023-34104

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

CVE-2023-34104 Regex Injection via Doctype Entities

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

Malicious code in fc-transactions-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b4aa758a82c1ef95eb8cec01a5206c1000e9ae259eab65eac788bb629690c5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...