MAL-2023-186 Malicious code in cms-businesslogic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0db779bc3d95749d4bb288d33d42d6febc864b8ab1ce8b51b5ddba5cfac9298 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Drupal 7.x < 7.95 / 9.4.x < 9.4.12 / 9.5.x < 9.5.5 / 10.x < 10.0.5 Multiple Vulnerabilities (drupal-2023-03-15)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.95, 9.4.x prior to 9.4.12, 9.5.x prior to 9.5.5, or 10.x prior to 10.0.5. It is, therefore, affected by multiple vulnerabilities. - Drupal core provides a page that outputs the markup...

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-002

The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files. This release was coordinated with SA-CONTRIB-2023-010. This advisory is not covered by Drupal Steward...

CVE-2023-26461 XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)

SAP NetWeaver allows SAP Enterprise Portal - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files and data. It allows the attacker to view...

Fedora 38 : mingw-python-OWSLib (2023-9a878398a6)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9a878398a6 advisory. Update to OWSLib-0.28.1, fixes CVE-2023-27476. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

XML External Entity (XXE)

php-dompdf is vulnerable to XML External Entity XXE attacks. SVG images are not processed through Dompdf's resource validation logic, allowing attackers to use remote resources, local filesystem paths, and vulnerable protocols without restriction...

Intel® Quartus® Advisory

This advisory contains CVEs in Altera products and has been transferred to Altera for support. The updated advisory can be found at the link below: https://www.altera.com/product-security/advisory-archive/intel-sa-00632.html...

CVE-2023-1288

An XML External Entity injection XXE vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server...

CVE-2023-1288 ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability

An XML External Entity injection XXE vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server...

CVE-2023-1288

CVE-2023-1288 affects Dassault Systèmes ENOVIA Live Collaboration V6R2013xE. The connected sources describe an XML External Entity (XXE) vulnerability that allows an attacker to read local files on the server (remote read; potential RCE not clearly stated in the documents). The root cause is an X...

CVE-2023-1288 ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability

An XML External Entity injection XXE vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server...

XML External Entity (XXE)

owslib is vulnerable to XML External Entity XXE. The vulnerability is due to allowing lxml entity resolution, which allows an attacker to read arbitrary files by parsing a crafted XML document...

SUSE CVE-2023-27476

OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...

Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2023-1510)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Dassault Systèmes ENOVIA Live Collaboration V6R2013xE 代码问题漏洞

Dassault Systèmes ENOVIA Live Collaboration V6R2013xE is a product lifecycle management PLM software from Dassault Systèmes, France. A code issue vulnerability exists in Dassault Systèmes ENOVIA Live Collaboration versions V6R2013xE through V6R2013xE FP, which stems from the discovery of an XML...

PT-2023-16863 · Dsm · Enovia Live Collaboration

Name of the Vulnerable Software and Affected Versions: ENOVIA Live Collaboration version V6R2013xE Description: An XML External Entity injection XXE vulnerability allows an attacker to read local files on the server, which can also lead to Remote File inclusions. Recommendations: For ENOVIA Live...

XWiki Platform vulnerable to data leak via Improper Restriction of XML External Entity Reference

Impact Any user with edit rights on a document can trigger a XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. Example to reproduce: Create a forget XAR file and inside it, have the following package.xml content: xml Helper pages...

GHSA-GX4F-976G-7G6V XWiki Platform vulnerable to data leak via Improper Restriction of XML External Entity Reference

Impact Any user with edit rights on a document can trigger a XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. Example to reproduce: Create a forget XAR file and inside it, have the following package.xml content: xml Helper pages...

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity

The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year. While the first attack in May 2022 entailed the use of a vulnerable version of a certificate software that's wide...

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity

The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year. While the first attack in May 2022 entailed the use of a vulnerable version of a certificate software that's wide...