31815 matches found
Malicious code in @jito-lab/provider (npm)
The package communicates with a domain associated with malicious activity...
CVE-2024-34711
GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. By default, GeoServer use...
CVE-2025-49190
The application is vulnerable to Server-Side Request Forgery SSRF. An endpoint can be used to send server internal requests to other ports...
CVE-2025-44044
Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity XXE. An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system...
VMware AVI Load Balancer 安全漏洞
VMware Avi Load Balancer is a load balancing platform from VMware. VMware Avi Load Balancer suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL...
CVE-2025-31039
Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through = 1.0.3...
CVE-2025-5877
A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml...
CVE-2025-5986
A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data e.g. using /dev/urandom on Linux or to...
Files or Directories Accessible to External Parties
Overview github.com/minio/minio/cmd is an open source object storage server compatible with Amazon S3 APIs. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the function ListMultipartUploads in the file erasure-server-pool.go. An attacker...
Malicious code in mh-swagger-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c511d3eda3b228d180191f4caee04bad5746d8134a082644b776b462f4b2eb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability of the WebDAV protocol implementation in Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the WebDAV protocol implementation in Windows operating systems is related to the loading of files of a dangerous type due to improper external control of the name or file. Exploiting this vulnerability allows a malicious actor to execute arbitrary code when a user accesses a...
GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity XXE vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files Patches...
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
Summary GeoServer Web Feature Service WFS web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity XXE processing attack. It is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers. This allows for Out-of-Band OOB data...
GHSA-JJ54-8F66-C5PC [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
Summary GeoServer Web Feature Service WFS web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity XXE processing attack. It is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers. This allows for Out-of-Band OOB data...
CVE-2025-47956
External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...
CVE-2025-33053
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network...
thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking
The Mozilla Foundation's Security Advisory describes the following issue: It is possible to craft an email that shows a tracking link as an attachment. If the user attempts to open the attachment, Thunderbird automatically accesses the link. The configuration to block remote content does not...
thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link
The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to...
thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking
The Mozilla Foundation's Security Advisory describes the following issue: It is possible to craft an email that shows a tracking link as an attachment. If the user attempts to open the attachment, Thunderbird automatically accesses the link. The configuration to block remote content does not...
CVE-2025-44044
Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity XXE. An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system...