MAL-2024-927 Malicious code in arduino-ide-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dcf7ca9bf0f189fb107121b5376feaf1535112a7c3e0c2d426fb74d95e3bf8f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-3486 · Eclipse · Eclipse Target Management

Name of the Vulnerable Software and Affected Versions: Eclipse Target Management: Terminal and Remote System Explorer RSE versions = 4.5.400 Description: The issue exists due to the lack of measures to neutralize special elements used in operating system commands. This allows a remote attacker to...

net.enilink.komma:net.enilink.komma.common.ui.rcp (>=1.4.0 <=1.7.4), net.enilink.komma:net.enilink.komma.edit.ui.feature (>=1.4.2 <=1.7.4) +69 more potentially affected by CVE-2023-4218 via org.eclipse.platform:org.eclipse.ui.ide (>=3.13.0 <=3.21.0)

org.eclipse.platform:org.eclipse.ui.ide MAVEN version =3.13.0, =1.4.0, =1.4.2, =1.4.0, =1.4.2, =1.4.0, =1.3.2, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.2.0 and more Source cves: CVE-2023-4218 Source advisory: OSV:GHSA-J24H-XCPC-9JW8...

The vulnerability of the ide_dma_cb() function in the QEMU hardware emulation software allows a attacker to gain access to read, modify, or delete data, or to cause a service failure.

The vulnerability of the idedmacb function in the QEMU hardware emulation software is related to synchronization errors when processing the DRQSTAT parameter. Exploiting this vulnerability can allow an attacker to gain access to read, modify, or delete data, or cause a service failure...

SUSE CVE-2023-4218

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

GHSA-CC4W-3CFF-J8FW Duplicate Advisory: Eclipse IDE XXE in eclipse.platform

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j24h-xcpc-9jw8. This link is maintained to preserve external references. Original Description In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE...

Duplicate Advisory: Eclipse IDE XXE in eclipse.platform

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j24h-xcpc-9jw8. This link is maintained to preserve external references. Original Description In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE...

CVE-2023-4218

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

Open redirect

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

CVE-2023-4218

CVE-2023-4218 is an XXE vulnerability in Eclipse IDE

CVE-2023-4218 XXE in eclipse.platform / Eclipse IDE

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

CVE-2023-4218 XXE in eclipse.platform / Eclipse IDE

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

CVE-2023-4218 XXE in eclipse.platform / Eclipse IDE

In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch...

Eclipse IDE code problem vulnerability

Eclipse IDE is a cross-platform open source integrated development environment from the Eclipse Foundation of Canada. A security vulnerability exists in versions of Eclipse IDE prior to 2023-09 4.29, which stems from the fact that certain files containing xml content are susceptible to a variety ...

PT-2023-28286 · Eclipse +2 · Eclipse Ide +2

Name of the Vulnerable Software and Affected Versions: Eclipse IDE versions prior to 2023-09 4.29 Description: The issue concerns the parsing of XML content in certain files, making them vulnerable to XXE attacks. This can occur when a user opens a malicious project or updates an open project wit...

CVE-2023-5088 Qemu: improper ide controller reset can lead to mbr overwrite

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead potentially overwriting the VM's boot code. This could be used, for example, by L2 guests with a virtual disk vdiskL2 stored on a virtual disk of an L1 vdiskL1...

CVE-2023-5088 Qemu: improper ide controller reset can lead to mbr overwrite

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead potentially overwriting the VM's boot code. This could be used, for example, by L2 guests with a virtual disk vdiskL2 stored on a virtual disk of an L1 vdiskL1...

GHSA-M5JC-R4GF-C6P8 Arduino Create Agent path traversal - arbitrary file deletion vulnerability

Impact The vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders...

Arduino Create Agent path traversal - arbitrary file deletion vulnerability

Impact The vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders...

Arduino Create Agent path traversal - local privilege escalation vulnerability

Impact The vulnerability affects the endpoint /upload which handles request with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduin...