MAL-2024-346 Malicious code in wlwz-2312-1905 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 300df546d6136a134227a24c19f3b576ad0985fbf9278cb84465c0849df6a17a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-28366 · Sap · Sap Commerce Cloud

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud versions HY COM 1905 through HY COM 2205, COM CLOUD 2211 Description: A locked B2B user can misuse the forgotten password functionality to un-block their user account again and re-gain access if SAP Commerce Cloud -...

CVE-2023-1905

The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2023-1905 WP Popups < 2.1.5.1 - Contributor+ Stored XSS

The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2023-1905

The CVE-2023-1905 vuln concerns the WP Popups WordPress plugin prior to version 2.1.5.1. The issue is an insufficient escape of the href attribute for the spu-facebook-page shortcode, leading to potential Stored XSS for users with the contributor role or higher when the shortcode is embedded in a...

CVE-2023-1905 WP Popups < 2.1.5.1 - Contributor+ Stored XSS

The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

Important: Red Hat Security Advisory: java-1.8.0-openjdk security update

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having ...

RHEL 8 : java-1.8.0-openjdk (RHSA-2023:1905)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1905 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

WordPress WP Popups Plugin < 2.1.5.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Popups Type Plugin Vulnerable versions 2.1.5.1 Fixed in 2.1.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1905 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 10bebf67691e Credits Erwan LR Required...

SUSE CVE-2006-1905

Multiple format string vulnerabilities in xiTK xitk/main.c in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file...

Amazon Linux 2 : pcs (ALAS-2023-1905)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1905 advisory. A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects...

SAP Commerce 输入验证错误漏洞

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. This product supports sales management, marketing management, order management and operations management. An input validation error vulnerability exists in SAP Commerce versions 1905, 2005, 2105, 2011, and 2205, which ca...

CVE-2022-1905 Events Made Easy < 2.2.81 - Unauthenticated SQLi

The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2022-1905

The CVE-2022-1905 entry documents an SQL injection in the WordPress plugin “Events Made Easy” before version 2.2.81. The vulnerability arises from improper sanitisation and escaping of a parameter used in a SQL statement via an unauthenticated AJAX action, allowing an attacker to inject SQL. The ...

The vulnerability of the Demon 1905 microprogramming system’s MediaTek MT7603E, MT7610, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, and MT7915 microchips allows attackers to enhance their privileges.

The vulnerability of the MediaTek M7603, M7610, M7613, M7615, M7620, M7622, M7628, M7629, and M7915 microprogrammed software chips lies in the ability to write beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain elevated privileges...

The vulnerability of the Demon 1905 microprogramming system’s MediaTek MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, and MT7915 microchips allows attackers to enhance their privileges.

The vulnerability of the MediaTek M7603, M7613, M7615, M7622, M7628, M7629, and M7915 microprogrammed software chips lies in the ability to write beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

The vulnerability of the Demon 1905 microprogramming system’s MediaTek MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, and MT7915 microchips allows attackers to enhance their privileges.

The vulnerability of the MediaTek M7603, M7613, M7615, M7622, M7628, M7629, and M7915 microprogrammed software chips lies in the ability to write beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

The vulnerability of the Demon 1905 microprogramming system’s MediaTek MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, and MT7915 microchips allows attackers to enhance their privileges.

The vulnerability of the MediaTek M7603, M7613, M7615, M7622, M7628, M7629, and M7915 microprogrammed software chips lies in the ability to write beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

The vulnerability of the MediaTek MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, and MT7915 microprogramming-based chips from the Demon model in 1905 allows a hacker to trigger a service failure.

The vulnerability of the MediaTek MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, and MT7915 microprogrammed software chips in 1905 is related to the lack of authentication. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the Demon 1905 microprogramming system’s MediaTek MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, and MT7915 microchips allows attackers to enhance their privileges.

The vulnerability of the MediaTek M7603, M7613, M7615, M7622, M7628, M7629, and M7915 microprogrammed software chips lies in the ability to write beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...