Design/Logic Flaw

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

CVE-2022-30929

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

CVE-2022-30929

CVE-2022-30929 affects Mini-Tmall v1.0 and is described as vulnerable to insecure permissions via the Tomcat Jasper embedding component (tomcat-embed-jasper). Several connected sources reiterate an insecure privilege/permission issue, including Red Hat and CNNVD entries, which label it as an inse...

Mini-Tmall 安全漏洞

Mini-Tmall is a Spring Boot-based mini-Tmall mall , fast deployment run , suitable for use as a Bijou template . A security vulnerability exists in Mini-Tmall v1.0. An attacker exploits the vulnerability to perform an insecure privilege attack via tomcat-embed-jasper...

CVE-2022-30929: Incorrect Permission Assignment for Critical Resource

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

Brizy Page Builder < 2.4.2 - Contributor+ Stored Cross-Site Scripting via Element Content

The plugin does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks As a contributor or above, create a post using Brizy editor and: - Add a Text Element then put the following payload:...

Malicious code in runkit-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d1a12cf5df9a43c706a5f3c73571ad7199f6a81dd67d4b94d6b91ad149a5f5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5867 Malicious code in runkit-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d1a12cf5df9a43c706a5f3c73571ad7199f6a81dd67d4b94d6b91ad149a5f5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in o-ads-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e617444fa6eff36ff9ae61eef4ce48b59a35c4e7f8f9c6a26159b22bde1cb6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4992 Malicious code in o-ads-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e617444fa6eff36ff9ae61eef4ce48b59a35c4e7f8f9c6a26159b22bde1cb6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wix-music-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 883da00a86a30f54e03a143ee6f22b5e9e9e80c09c21a84dea6fd3d6ca36f813 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7172 Malicious code in wix-music-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 883da00a86a30f54e03a143ee6f22b5e9e9e80c09c21a84dea6fd3d6ca36f813 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in forms-embed-utils-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf97fb0f32cd32091dcbca4ce7c70f578f20c58517aac7986b936e4e76bf16f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3110 Malicious code in forms-embed-utils-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf97fb0f32cd32091dcbca4ce7c70f578f20c58517aac7986b936e4e76bf16f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4533 Malicious code in media-server-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe2194f7f7af27a6e37ef504b65dc6d2acef0181506af8e587227fad7b449f21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in media-server-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe2194f7f7af27a6e37ef504b65dc6d2acef0181506af8e587227fad7b449f21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tiktok_embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7efd23c732b9d63531a53f0dc12b58d8c1cc7fbaec7d4c0ada1bef6fb113c4b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Form - Contact Form <= 1.2.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed Create/edit a form, add a Custom Text field, put the following payload in it: alert/XSS/, save the field...

CVE-2021-27781

The Master operator may be able to embed script tag in HTML with alert pop-up display cookie...

DRUPAL-CONTRIB-2022-042

The Drupal Embed module provides a filter to allow embedding various embeddable items like entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed items. In some...