libxml2: integer overflows with XML_PARSE_HUGE

A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation...

MAL-2023-24 Malicious code in @balea-telefonica/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 563059871426877f31b5ba1bd33fda80482ee48032d184d83e400daf25d54b99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Linux 8 : libxml2 (ELSA-2023-0173)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0173 advisory. - Fix CVE-2022-40303 2136562 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...

PT-2023-19067 · Blue Coat · Bluecat Device Registration Portal

Name of the Vulnerable Software and Affected Versions: BlueCat Device Registration Portal version 2.2 Description: The issue allows XXE attacks that can exfiltrate single-line files, potentially containing credentials, such as those found in .netrc files. For example, a single-line file might...

BlueCat Networks Device Registration Portal 代码问题漏洞

BlueCat Networks Device Registration Portal is a standalone application from BlueCat Networks, Inc. for auditing and tracking all devices attempting to connect to the network. A security vulnerability exists in BlueCat Networks Device Registration Portal version 2.2 that stems from an XXE attack...

CVE-2023-23595: Improper Restriction of XML External Entity Reference

BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .netrc file format. NOTE: 2.x versions are no longer supported...

Information disclosure

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds...

XML External Entity (XXE) Injection

aXMLRPC is vulnerable to XML external entity attacks. The vulnerability exists because the library does not properly validate the XML documents submitted by the users via the parse function of ResponseParser.java, allowing an attacker to inject malicious XML documents to perform requests on behal...

MAL-2023-571 Malicious code in lucifoxero (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24e496d1286f59f364036c6adac3c875c49e090d2a787ad96a135a6b8476fb85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lucifoxero (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24e496d1286f59f364036c6adac3c875c49e090d2a787ad96a135a6b8476fb85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate

A use-after-free flaw was found in the Expat package, caused by destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. This may lead to availability disruptions...

MAL-2023-161 Malicious code in cas-core-renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26d20be8c341ff87fc8ce4d2871dea36d7e1f5d778de7bc62e991d54c73764b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-212 Malicious code in create-or-update-comment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 529afddb0ce1c2ffee5a4ae20c89657596df9fb27440956e1f78e8f6b80cb67c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-80 Malicious code in action-surefire-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dd64ecec34f5bd03737caac41ac1993aafb8bfc6ac4de27c5ff59368d76b4f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-500 Malicious code in hiring-without-whiteboards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c86a6c1ba7eeb700ad39245d9f6e5bd53cee80dcfdd43819e13ea756c0cc3be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-106 Malicious code in asdtestaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a81207a96568ae9a6efe36a302eb8dfa7d832a0d45836428a23dc7427ac953fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-474 Malicious code in github-actions-slack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0838fb57bbc4692fe40f976eb83599cc51f263c1c3a3eb1b231cbb7939a34a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Maximo Asset Management, IBM Maximo Manage in IBM Maximo Application Suite and IBM Maximo Manage in IBM Maximo Application Suite as a Service may be affected by XML External Entity (XXE) attacks (CVE-2021-33813)

Summary IBM Maximo Asset Management, IBM Maximo Manage in IBM Maximo Application Suite and IBM Maximo Manage in IBM Maximo Application Suite as a Service may be affected by XML External Entity XXE attacks. Vulnerability Details CVEID:CVE-2021-33813 DESCRIPTION: JDOM is vulnerable to a denial of...

MAL-2023-464 Malicious code in ftx.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5135d751992b5d4c6a940cfaf74fe516bcb12b50bdcb801313933da407c5a33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stake.fish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c198061bbe55dd2f115328a3de12953984382e472f1c6044d6eb9ea36b13edb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...