MAL-2024-10325 Malicious code in kakakakka (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e063b8852b345979ae3d75e4c6ab7f3ed469a5c393eff7061afa0de4db66fc69 The OpenSSF Package Analysis project identified 'kakakakka' @ 2.4.6 npm as malicious. It is considered malicious because: - The package...

WordPress plugin Add Widget After Content 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2024-39918 · WordPress · Add Widget After Content

Name of the Vulnerable Software and Affected Versions: Add Widget After Content plugin for WordPress versions up to, and including, 2.4.6 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows...

WordPress Admin Management Xtended plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc Patchstack Alliance in WordPress Plugin Admin Management Xtended versions = 2.4.6...

WordPress Admin Management Xtended Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)

Software Admin Management Xtended Type Plugin Vulnerable versions = 2.4.6 Fixed in 2.4.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49307 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 966456ab80af Credits Trương Hữu Phúc truonghuuphuc...

Fermax com.fermax.vida 安全漏洞

Fermax com.fermax.vida is a firmware program from Fermax, Inc. A security vulnerability exists in Fermax com.fermax.vida version 2.4.6, which stems from contains a vulnerability that allows remote attackers to obtain sensitive information through the firmware update process...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass due to improper handling of sensitive information. An attacker with administrative privileges can bypass security features, leading to a low impact on...

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization allowing a low-privileged attacker to escalate privileges and bypass security measures to affect confidentiality without user interaction. Remediatio...

GHSA-J3MH-WX5F-2VHG Magento Open Source Information Exposure vulnerability

Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in furth...

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization allowing a low-privileged attacker could bypass security measures and impact confidentiality and integrity without user interaction. Remediation...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. A low-privileged attacker could bypass security measures and impact system integrity by exploiting this vulnerability without requiring user...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. An attacker can bypass security measures and have a low impact on integrity by exploiting this vulnerability. Remediation Upgrade...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. An attacker can escalate privileges by leveraging the improper access control settings. Remediation Upgrade magento/community-edition to version...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of security policies. A low-privileged attacker can bypass security features by exploiting this vulnerability without us...

Improper Input Validation

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Input Validation through the PHP filter chain. An attacker with administrative privileges can read files from the system outside of the intended directories and...

Magento Open Source Improper Access Control vulnerability

Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on...

GHSA-46FM-X82M-5F74 Magento Open Source Improper Access Control vulnerability

Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact o...

Magento Open Source Cross-Site Scripting (XSS) vulnerability

Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting XSS vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially crafted link or submitting a form, malicious...

Magento Open Source reflected Cross-Site Scripting (XSS) vulnerability

Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the...

GHSA-W3P2-PC3H-69WV Magento Open Source Improper Access Control vulnerability

Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity...