CVE-2023-27874 IBM Aspera Faspex XML external entity injection

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845...

CVE-2023-27874 IBM Aspera Faspex XML external entity injection

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845...

PT-2023-14897 · Visam · Visam Vbase Automation Base

Name of the Vulnerable Software and Affected Versions: VISAM VBASE Automation Base versions prior to 11.7.5 Description: The issue may disclose information if a valid user opens a specially crafted file. This is related to XML External Entity Processing in the context of file parsing, specificall...

PT-2023-14017 · Visam · Visam Vbase Automation Base

Name of the Vulnerable Software and Affected Versions: VISAM VBASE Automation Base versions prior to 11.7.5 Description: The issue may disclose information if a valid user opens a specially crafted file. This is related to XML External Entity Processing in the FB.XML file parsing. Recommendations...

XXE vulnerability in perfpublisher

perfpublisher 8.09 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control PerfPublisher report files to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins...

XXE vulnerability in phabricator-plugin

phabricator-plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control coverage report file contents for the 'Post to Phabricator' post-build action to have Jenkins parse a crafted XML document that uses external...

XXE vulnerability in absint-a3

absint-a3 1.1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control 'Project File APX' contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controlle...

XXE vulnerability in vs-code-metrics

vs-code-metrics 1.7 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control VS Code Metrics File contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins...

PT-2023-21387 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 4.4.2 Description: The issue is related to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this to execute arbitrary commands. Recommendations: For...

PT-2023-10823

Name of the Vulnerable Software and Affected Versions zwczou WeChat SDK Python versions 0.3.0 through 0.5.4 Description A critical issue affects the validate/to xml function, leading to xml external entity reference. The attack may be initiated remotely. Recommendations To address this issue,...

PT-2023-14676 · Visam · Visam Vbase Automation Base

Name of the Vulnerable Software and Affected Versions: VISAM VBASE Automation Base versions prior to 11.7.5 Description: The issue may disclose information if a valid user opens a specially crafted file. This occurs due to improper handling of XML External Entity XXE processing in the file parsin...

VISAM VBASE 代码问题漏洞

VISAM VBASE is a data acquisition and monitoring system from VISAM Germany. A code issue vulnerability exists in VISAM VBASE Automation Base prior to version 11.7.5, which stems from an improper restriction on XML external entity references, and can be exploited by an attacker to trick a user int...

Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2023-112)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-112 advisory. Possible remote code execution vulnerability in the ClamAV HFS+ file parser. The issue affects ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. CVE-2023-20032 A...

PT-2023-6142 · Unknown · Vbase Automation Base

Name of the Vulnerable Software and Affected Versions: VBASE Automation Base versions prior to 11.7.5 Description: The issue is related to incorrect restriction of XML external entity references, which can lead to information disclosure when a valid user opens a specially crafted file. This may...

VISAM VBASE 代码问题漏洞

VISAM VBASE is a data acquisition and monitoring system from VISAM Germany. A code issue vulnerability exists in VISAM VBASE Automation Base prior to version 11.7.5, which stems from an improper restriction on XML external entity references, and can be exploited by an attacker to trick a user int...

weixin-python 代码问题漏洞

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A code issue vulnerability exists in weixin-python version 0.3.0, which stems from the presence of xml external...

Important: kernel

Issue Overview: A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM L0 advertising eIBRS support to L1. An attacker at L...

IBM Aspera 代码问题漏洞

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.2 is vulnerable to XML external entity injection, which stems from not setting the correct filter to allow references to external entities whe...

CBL Mariner 2.0 Security Update: clamav (CVE-2023-20052)

The version of clamav installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-20052 advisory. - On February 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A...

Fedora 36 : mingw-python-OWSLib (2023-ae06b3704c)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-ae06b3704c advisory. Update to OWSLib-0.28.1, fixes CVE-2023-27476. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...