Business-central 代码问题漏洞

Business-central is a software package. A security vulnerability exists in Business-central that stems from the possibility of receiving an XML external entity injection attack...

Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2

In versions prior to 3.3.2, Hudson exhibits a flaw in its XML API processing that can allow access to potentially sensitive information on the filesystem of the Hudson master server...

GHSA-J3H2-8MF8-J5R2 Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2

In versions prior to 3.3.2, Hudson exhibits a flaw in its XML API processing that can allow access to potentially sensitive information on the filesystem of the Hudson master server...

CVE-2022-2131

OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack...

Malicious code in nmgpvbyzeufscxjh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ef3cb78242f21839f9932efac0bec33fa4eb78d39d685bdb5541e2d2a9055c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ohwczbeuslaxvpmd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c959b5a985a72d8c0cd2177512887ec29d8b85ce98adc5e0c9b90d4c2e7fe1e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1747 Malicious code in byxctlvkeqhduiza (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 981d84fff485e2abe8d3ac19a4328cc7ab70e98cc378f1a4966bc3776ce2f539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hldqgyckmuwxjefs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c36bd592f3ed72aefd6e362450c65f36a30e0add033ca8d4843a6b5d7c485ed6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML External Entity (XXE)

org.eclipse.lyo.oslc4j.core:oslc4j-jena-provider is vulnerable to XML external entity attack. Default initialization of createTransformer does not restrict DTD document loading when working with RDF/XML formats, which allows remote attackers to retrieve external DTD documents...

CVE-2022-32458

Digiwin BPM has a XML External Entity Injection XXE vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files...

GHSA-6296-MVGP-27HP XML External Entity Reference in Eclipse Lyo

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved...

mysql-connector-java: unauthorized access to critical

MySQL Connector/J has no security check when external general entities are included in XML sources, consequently, there exists an XML External EntityXXE vulnerability. A successful attack can access critical data and gain full control/access to all MySQL Connectors' accessible data without any...

Security Bulletin: IBM Tivoli Network Manager is vulnerable to XML external entity (XEE) attacks due to FasterXML (CVE-2020-25649)

Summary FasterXML Jackson Databind, used by IBM Tioli Network Manager,contains a flaw where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity. The library has been...

GHSA-H975-R69H-4W9P Insufficient user input in Apache Jetspeed-2

UNSUPPORTED WHEN ASSIGNED Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant projec...

Malicious code in footericon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5abd7d180b20b8c2f5eb6e7ed38e468ff34f377559f4cf012a298bebdebbaf99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-32533

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no...

CVE-2022-32533

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no...

Security Bulletin: A security vulnerability has been identified in Apache POI shipped with IBM Tivoli Netcool Impact (CVE-2019-12415)

Summary Apache POI is shipped with IBM Tivoli Netcool Impact. Information about a security vulnerability affecting Apache POI has been published in a security bulletin. Vulnerability Details CVEID: CVE-2019-12415 DESCRIPTION: Apache POI could allow a remote attacker to obtain sensitive informatio...

The vulnerability of the cewolf component of the Windows Active Directory (AD) management and reporting software Zoho ManageEngine ADAudit Plus allows attackers to perform XXE attacks.

The vulnerability of the cewolf component of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to perform XXE attack...

PT-2022-21354 · Apache · Apache Jetspeed-2

Name of the Vulnerable Software and Affected Versions: Apache Jetspeed-2 affected versions not specified Description: The issue arises from insufficient filtering of untrusted user input by default, leading to problems such as XSS, CSRF, XXE, and SSRF. Setting the configuration option...