Xxe

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity XXE attacks...

CVE-2021-21680

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity XXE attacks...

The vulnerability of the microprogramming software of the modular controller for transformer substations automation by Schneider Electric Easergy T300 RTU, related to access control deficiencies, allows a intruder to gain unauthorized access to protected information, cause service failures, or execute arbitrary commands.

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 RTU-based transformer automation systems is related to deficiencies in access control. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to...

WEM Transformer: SSON is not working

If attempting to log on to WEM transformer via SSO with an individual user account, SSO does not work, the user needs to re-enter their credentials to logon to workspace...

Getty104 qiita-markdown 跨站脚本漏洞

Getty104 qiita-markdown is Getty104 an open source application . It provides an editor function. A cross-site scripting vulnerability exists in Qiita Markdown before 0.33.0, which originates from transformer...

Zip-slip mitigation bypass in Spring Integration Zip extension

spring-integration-zip , versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So when the filename gets concatenated to...

Training Transformers for Cyber Security Tasks: A Case Study on Malicious URL Prediction

Highlights Perform a case study on using Transformer models to solve cyber security problems Train a Transformer model to detect malicious URLs under multiple training regimes Compare our model against other deep learning methods, and show it performs on-par with other top-scoring models Identify...

Prototype Pollution

ioredis is vulnerable to prototype pollution. The vulnerability exists as the reply transformer does not check for special field names and mishandles malicious keys proto, which could, at worst, result in a denial of service condition due to limitations of not being able to overwrite global...

The vulnerability of the microprogramming software of the modular controller for automation of transformer substations—Schneider Electric Easergy T300 module SC150—is related to incorrect user authentication. This vulnerability allows a intruder to view and modify the device configuration file.

The vulnerability of the microprogramming software of the modular controller for automation of transformer substations in Schneider Electric Easergy T300 RTU devices is related to incorrect user authentication. Exploiting this vulnerability allows a malicious actor to remotely view and modify the...

@arnau/gatsby-transformer-toml (>=1.0.0 <=1.0.2) potentially affected by CVE-2020-28462 via ion-parser (=0.5.2)

ion-parser NPM version =0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on ion-parser and may be impacted: - @arnau/gatsby-transformer-toml =1.0.0, =1.0.2 Source cves: CVE-2020-28462 Source advisory: SNYK:JS-IONPARSER-1048971...

CVE-2020-24649

A remote bytemessageresource transformentity" input validation code execution vulnerability was discovered in HPE Intelligent Management Center iMC versions: Prior to iMC PLAT 7.3 E0705P07...

apache-commons-collections: InvokerTransformer code execution during deserialisation

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

EAP: XXE issue in TransformerFactory

It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed...

The vulnerability of the microprogramming software of the modular controller for the automation of transformer substations of Schneider Electric Easergy T300 (HU250) is related to the use of a less secure encryption algorithm. This allows a hacker to obtain the password.

The vulnerability of the microprogramming software of the modular controller for the automation of transformer substations of Schneider Electric Easergy T300 HU250 is related to the use of a less secure encryption algorithm. Exploiting this vulnerability could allow an attacker operating remotely...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems for transformer substations involves insecure management of privileges. This allows attackers to escalate their privileges and perform arbitrary file writing and deletion operations on the device.

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 HU250 automation systems for transformer substations is related to insecure privilege management. Exploiting this vulnerability allows an attacker to escalate their privileges and perform arbitrar...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems for transformer substations, related to the manipulation of inter-site requests, allows a perpetrator to execute malicious commands under the identity of an authorized user.

The vulnerability of the microprogrammed control module software for automation of transformer substations in Schneider Electric Easergy T300 HU250 is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute malicio...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems, related to the use of vulnerable external software, allows attackers to carry out various attacks on these components.

The vulnerability of the microprogramming software of the modular controller for the automation of transformer substations of Schneider Electric Easergy T300 HU250 is related to the use of a vulnerable external software. Exploiting this vulnerability allows a malicious actor to carry out various...

The vulnerability of the microprogrammed software of the modular controller for the automation of transformer substations of Schneider Electric Easergy T300 (HU250) – related to uncontrolled resource consumption – allows a intruder to trigger a maintenance failure.

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 HU250 for transformer substations automation involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause malfunctions in the system due ...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems for transformer substations lies in the improper limitation on the number of unsuccessful authentication attempts. This allows a perpetrator to gain full access.

The vulnerability of the microprogrammed control module software for automation of transformer substations in Schneider Electric Easergy T300 HU250 is related to an improper limitation on the number of unsuccessful authentication attempts. Exploiting this vulnerability can allow a malicious actor...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems in transformer substations stems from the lack of protection for operational data. This allows a malicious individual to compromise the closed keys used by the device.

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 HU250 automation systems in transformer substations is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to compromise the closed keys...