[SECURITY] [DLA 3276-1] lava security update

Debian LTS Advisory DLA-3276-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany January 19, 2023 https://wiki.debian.org/LTS Package : lava Version : 2019.01-5+deb10u2 CVE ID : CVE-2022-44641 Debian Bug : 1024429 Igor Ponomarev discovered that LAVA, a continuous...

Security Bulletin: IBM MQ Explorer is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2022-22489)

Summary IBM MQ Explorer is vulnerable to an XML External Entity Injection XXE attack due to improper XML validation in the import Wizard. Vulnerability Details CVEID:CVE-2022-22489 DESCRIPTION: IBM MQ is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote...

XML External Entity (XXE)

swift is vulnerable to XML External Entity XXE attacks. The vulnerability allows a remote authenticated attacker to access potentially sensitive data in S3 buckets by persuading the S3 API into returning arbitrary file contents from the host server...

DRUPAL-CORE-2023-001

The Media Library module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access. The vulnerability is mitigated by the fact that the inaccessible media will only be visib...

DRUPAL-CONTRIB-2023-002

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. Entity Browser does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about entities they are not...

MAL-2023-797 Malicious code in speedtestkas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8836f24997a907538aecb95c00484874123e3c82cfc14af5aa48eba61723a6c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-798 Malicious code in speedtesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea291fb5f10bb5f4fec190257342afa539f082d724229d3316d408ba2277c5ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-799 Malicious code in speedtestrun (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b100bd6200644b48f81811927710a78c261d325facb39b0425c7da01f37d6f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-801 Malicious code in speedtestspa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c16c52565fd772129fa47bbfae8224b728ca331ccf58773d41d243df06bbb9de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-794 Malicious code in speedtestgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fdcbf7a838d1ab8733a1da6605dfb92935f0b70f7feaf91b79aba1fa85b685f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Entity Browser - Moderately critical - Information Disclosure - SA-CONTRIB-2023-002

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. Entity Browser does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about entities they are not...

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-001

The Media Library module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access. The vulnerability is mitigated by the fact that the inaccessible media will only be visib...

Media Library Form API Element - Moderately critical - Information Disclosure - SA-CONTRIB-2023-004

This module enables you to use the media library in custom forms without the Media Library Widget. The module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access. The...

CVE-2023-22624

Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks...

PT-2023-18594 · Zoho · Zoho Manageengine Exchange Reporter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Exchange Reporter Plus versions prior to 5708 Description: The issue allows attackers to conduct XXE XML External Entity attacks. This type of attack occurs when an application parses XML input that contains malicious extern...

ZOHO ManageEngine Exchange Reporter Plus 5708 代码问题漏洞

ZOHO ManageEngine Exchange Reporter is a hybrid Exchange and Skype for Business reporting, auditing and monitoring solution from ZOHO. A security vulnerability previously existed in ZOHO ManageEngine Exchange Reporter Plus version 5708, which stemmed from the presence of an XML external entity...

CVE-2023-21862: Improper Restriction of XML External Entity Reference

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware component: XML Security component. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web...

Reuse of signature to get KYCd after it has been removed

Lines of code Vulnerability details Impact There is no time limit on the validity off KYC digests and users with a removed KYC are not saved. If a issuer of such a digest is either compromised or if they by mistake issue a digest with a deadline far into the future a user could reuse the same...

CVE-2023-22624: Improper Restriction of XML External Entity Reference

Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks...

libxml2: dict corruption caused by entity reference cycles

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free...