Prodigysml

**Nome do software vulnerável e versões afetadas** Versões do Pydantic anteriores à 2.4.0 Versões do Pydantic anteriores à 1.10.13 **Descrição** O problema está relacionado ao uso de expressões regulares na biblioteca Pydantic, o que pode levar a uma negação de serviço quando explorado por um invasor remoto. Isso pode ser feito por meio de uma sequência de e-mail maliciosa, permitindo que o invasor cause uma negação de serviço. **Recomendações** Para versões anteriores à 2.4.0, atualize para a versão 2.4.0 ou posterior para resolver o problema. Para versões anteriores à 1.10.13, atualize para a versão 1.10.13 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Versões do Osmand anteriores à 2.1 **Descrição** A vulnerabilidade permite ataques XXE (Entidade Externa XML) devido a um problema no arquivo binary/BinaryMapIndexReader.java. Isso pode potencialmente levar ao acesso não autorizado aos dados. **Recomendações** Para versões do Osmand anteriores à 2.1, como solução temporária, considere restringir o acesso ao arquivo binary/BinaryMapIndexReader.java até que um patch esteja disponível. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Versões do Azkaban anteriores à 3.84.1 **Descrição** A vulnerabilidade permite ataques XXE (XML External Entity), relacionados aos arquivos `XmlValidatorManager.java` e `XmlUserManager.java` nos diretórios validator e user, respectivamente. Isso pode potencialmente levar ao acesso não autorizado a dados confidenciais. **Recomendações** Para versões anteriores à 3.84.1, atualize para a versão 3.84.1 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso às classes `XmlValidatorManager` e `XmlUserManager` até que um patch esteja disponível. Evite usar entidades XML externas nos módulos afetados para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** Versões do Mulesoft APIkit anteriores à 1.3.1 **Descrição** A vulnerabilidade permite ataques XXE (Entidade Externa XML) devido a um problema no processo de validação, especificamente no arquivo RestXmlSchemaValidator.java. Isso pode afetar potencialmente um grande número de dispositivos em todo o mundo, embora o número exato não tenha sido especificado. **Recomendações** Para versões anteriores à 1.3.1, atualize para a versão 1.3.1 ou posterior para resolver o problema. Como solução temporária, considere desativar o componente `validation/RestXmlSchemaValidator.java` até que um patch esteja disponível. Restrinja o acesso à validação do esquema XML para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** Versões do Accenture Mercury anteriores à 1.12.28 **Descrição** Existe uma vulnerabilidade de tipo XXE devido ao componente platformlambda/core/serializers/SimpleXmlParser.java. Essa vulnerabilidade permite uma possível exploração. **Recomendações** Para versões anteriores à 1.12.28, atualize para a versão 1.12.28 ou posterior para resolver a vulnerabilidade. Como solução temporária, considere restringir o acesso ao componente SimpleXmlParser.java até que um patch seja aplicado.

Name of the Vulnerable Software and Affected Versions: Quake3e versions prior to 5ed740d Description: The issue affects the component responsible for argument string creation, leading to a buffer overflow. This can result in possible code execution and denial of service. Recommendations: For versions prior to 5ed740d, update to a version that includes the fix for the buffer overflow issue to prevent possible code execution and denial of service.

Name of the Vulnerable Software and Affected Versions: libnmap versions prior to 0.6.3 Description: The issue is related to an XML injection vulnerability, similar to a Billion-Laughs style attack. This vulnerability can lead to a denial of service (DoS) by consuming resources. The component affected is the XML parsing functionality. The attack vector involves a specially crafted XML payload. Recommendations: For versions prior to 0.6.3, update to version 0.6.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XML parsing component to minimize the risk of exploitation. Avoid using the `NmapParser()` function with untrusted XML inputs until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: uLaunchELF versions prior to commit 170827a Description: The issue is related to a buffer overflow in the loader program, specifically in the loader.c component. This occurs because the loader program overly trusts the arguments provided via the command line. The impact of this issue is possible code execution and denial of service. Recommendations: For versions prior to commit 170827a, update to a version that includes the fix for the buffer overflow issue in the loader program. As a temporary workaround, consider restricting the use of command line arguments to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** autopsy versions prior to 4.9.1 **Description** The issue concerns a XML External Entity (XXE) vulnerability in the CaseMetadata XML Parser. This can lead to disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. The attack is exploitable via specially crafted CaseMetadata. **Recommendations** For versions prior to 4.9.1, update to version 4.9.1 or later to resolve the issue. As a temporary workaround, consider restricting the parsing of CaseMetadata XML to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** runelite versions prior to 1.4.23 **Description** The issue concerns a XML External Entity (XXE) vulnerability in the Man in the middle runscape services call. This can lead to the disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. **Recommendations** For versions prior to 1.4.23, update to version 1.4.23 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** KeePassDX versions prior to 2.5.0.0beta18 **Description** The issue concerns a XML External Entity (XXE) vulnerability in the kdbx file parser. This can lead to disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. **Recommendations** For versions prior to 2.5.0.0beta18, update to a version newer than 2.5.0.0beta17 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SoftwareX versions prior to 5.0.0-RC4 **Description** The issue is related to a XML External Entity (XXE) vulnerability in the XML Parser for the REST Server. This can lead to the disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. **Recommendations** For versions prior to 5.0.0-RC4, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** bw-calendar-engine versions prior to 3.12.0 **Description** The issue concerns a XML External Entity (XXE) vulnerability in the IscheduleClient XML Parser. This can lead to disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. The attack is exploitable via a Man in the Middle or a malicious server. **Recommendations** For versions prior to 3.12.0, update to version 3.12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the IscheduleClient XML Parser to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** UML Designer versions prior to 8.0.0 **Description** The issue concerns a XML External Entity (XXE) vulnerability in the XML parser for plugins. This can lead to the disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. The attack is exploitable via a malicious plugins.xml file. **Recommendations** For versions prior to 8.0.0, update to version 8.0.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** codelibs fess versions before commit faa265b **Description** The issue is related to a XML External Entity (XXE) vulnerability in the GSA XML file parser. This can lead to disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. The attack is exploitable via specially crafted GSA XML files. **Recommendations** For versions before commit faa265b, update to a version after commit faa265b to resolve the issue. As a temporary workaround, consider restricting the use of the GSA XML file parser until a patch is available. Avoid using specially crafted GSA XML files in the affected parser until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** MegaMek versions prior to 0.45.1 **Description** The issue in MegaMek can result in disclosure of confidential data, denial of service, SSRF, and remote code execution due to a vulnerability in the Object Stream Connection. **Recommendations** For versions prior to 0.45.1, update to version 0.45.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FrostWire versions prior to 6.7.4-build-272 **Description** The issue concerns a XML External Entity (XXE) vulnerability that can be exploited via a man-in-the-middle attack during the software update process. This can lead to the disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. **Recommendations** For versions prior to 6.7.4-build-272, update to a version newer than 6.7.4-build-272 to resolve the issue. As a temporary workaround, consider restricting access to the update mechanism to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ubilling versions prior to 0.9.3 **Description** The issue concerns a user-controlled parameter that can lead to disclosure of confidential data, denial of service, SSRF, and remote code execution. **Recommendations** For Ubilling versions prior to 0.9.3, update to version 0.9.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MicroMathematics versions prior to commit 5c05ac8 **Description** The issue concerns a XML External Entity (XXE) vulnerability in SMathStudio files, which can lead to the disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. This can be exploited through specially crafted SMathStudio files. **Recommendations** For versions prior to commit 5c05ac8, update to a version after commit 5c05ac8 to resolve the issue. As a temporary workaround, consider restricting the use of SMathStudio files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Anyplace versions prior to commit 80359b4 **Description** The issue is related to a XML External Entity (XXE) vulnerability in the Man in the middle on map API call. This can lead to the disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. **Recommendations** For versions prior to commit 80359b4, update to a version after commit 80359b4 to resolve the issue. As a temporary workaround, consider restricting access to the map API call to minimize the risk of exploitation.