CVE-2024-22219

CVE-2024-22219 is an XXE vulnerability affecting Terminalfour versions 8.0.0001 through 8.3.18 and XML JDBC up to 1.0.4. The Red Hat advisory confirms the flaw allows authenticated users to submit malicious XML via unspecified features, potentially enabling actions such as accessing the underlyin...

Ivanti Avalanche decodeToMap XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the decodeToMap method. Due to the improper restriction of XML External Entity...

CVE-2024-22219

XML External Entity XXE vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution RCE, or...

Security Bulletin: IBM Planning Analytics is affected by vulnerabilities in IBM Java and IBM Websphere Application Server Liberty

Summary There are vulnerabilities in IBM® Java™ Version 8 and IBM WebSphere Application Server Liberty used by both IBM Planning Analytics and IBM Planning Analytics Workspace. With respect to IBM Planning Analytics, applicable CVEs have been addressed by upgrading to non-vulnerable versions of...

Security Bulletin: Vulnerability in jackson-databind affects watsonx.data

Summary FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception and other causes Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception. By...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

CVE-2024-34102 ★ Thanks to @th3gokul, Sanjaith3hacker, Chocapi...

PT-2024-8675 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.1 Description: The issue is related to an XML External Entity XXE flaw in the SmartDeviceServer component of Ivanti Avalanche. This flaw allows a remote unauthenticated attacker to read arbitrary files on the...

Voltronic Power ViewPower XML External Entity Injection Vulnerability

Voltronic Power ViewPower is Voltronic Power's monitoring and management software for solar inverters. Voltronic Power ViewPower Pro suffers from an XML external entity injection vulnerability that can be exploited by attackers to disclose sensitive information...

CVE-2024-42482 fish-shop/syntax-check Improper Neutralization of Delimiters

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Liberty impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent.

Summary Multiple vulnerabilities in IBM WebSphere Liberty impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. Vulnerability Details CVEID:CVE-2024-25026 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Libert...

Security Bulletin: Maximo Application Suite - IBM WebSphere Application Server Liberty is vulnerable to CVE-2024-22354 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses WebSphere Application Server Liberty which is vulnerable to CVE-2024-22354. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere Application...

CVE-2024-6893

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources...

Malicious code in viewability-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d6ab3215e22d1ba76d15137a6915fc6703eb21620b8821706dc5b006ce735d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty - v.24.0.0.4 which is vulnerable to CVE-2024-27268 and CVE-2024-22353.

Summary IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty - v.24.0.0.4 which is vulnerable to CVE-2024-27268 and CVE-2024-22353. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-22353 DESCRIPTION: IBM...

Malicious code in diosaziose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e55eab0b1fe3321b359ded42ffc43ae4db39f3ff2dab487f6843d966631c5f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-3930

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity XXE was discovered...

CVE-2024-3930

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity XXE was discovered...

CVE-2024-3930 XML External Entity in Akana

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity XXE was discovered...

CVE-2024-3930 XML External Entity in Akana

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity XXE was discovered...

CVE-2024-3930

CVE-2024-3930 is an XML External Entity (XXE) vulnerability in Akana API Platform prior to 2024.1.0. The NVD entry cites CVSS v3.1: Base score 9.8 (CRITICAL) with network attack vector, no privileges or user interaction required, and impacts to confidentiality, integrity, and availability. Other ...