10116 matches found
CVE-2025-0509
creationtimestamp| type| source ---|---|--- 2025-02-04 20:13:05+00:00| seen| https://infosec.exchange/users/cve/statuses/113947442188091904 2025-02-04 20:16:03+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lheuqt3inl27 2025-02-04 22:15:18+00:00| seen|...
CVE-2025-24982
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted...
CVE-2025-0413
creationtimestamp| type| source ---|---|--- 2025-02-04 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-082/ 2025-02-04 23:16:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113948163353121381 2025-02-05 00:16:47+00:00| seen|...
WordPress Plugin "Activity Log WinterLock" vulnerable to cross-site request forgery
Overview WordPress Plugin "Activity Log WinterLock" provided by SWIT contains a cross-site request forgery vulnerability CWE-352. KENJI YOSHIKAWA reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a user vie...
CVE-2025-24982
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted...
CVE-2025-24982
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted...
CVE-2025-24982
The CVE-2025-24982 affects the WordPress plugin Activity Log WinterLock, specifically versions prior to 1.2.5. The vulnerability is a Cross‑Site Request Forgery (CSRF) that can cause log data to be deleted when a logged‑in user views a malicious page. No root cause details beyond CSRF are provide...
PT-2025-2952 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version of Discourse core Description: Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in th...
WordPress plugin Activity Log WinterLock 跨站请求伪造漏洞
WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists ...
Discourse 跨站脚本漏洞
Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from the fact that the activity stream in a user's profile page may be...
JVN#94806805: WordPress Plugin "Activity Log WinterLock" vulnerable to cross-site request forgery
WordPress Plugin "Activity Log WinterLock" provided by SWIT contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, the log data may be deleted. Solution Update the plugin Update the plugin according to the information provided by the...
CVE-2025-22918
creationtimestamp| type| source ---|---|--- 2025-02-03 21:15:53+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhchmvhxug2f 2025-02-03 22:08:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lhckkqqmmb2g 2025-02-03 23:41:03+00:00| seen|...
Malicious code in effect-layout-function (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-1228 Malicious code in precompiled-iris300 (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2fc49c5f492a6603e16701144ee66fabcdea41176b445eb496c8e9d11caccd4 Any computer that has this package installed or running should be considered...
MAL-2025-1037 Malicious code in guests (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90c450f222886a91d7c733fcfbdf4a4b5104c0b4a1d1931f79e0bea1201f1398 Any computer that has this package installed or running should be considered...
Malicious code in invalid-dependency (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in cth-poc (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in cg-be-package (npm)
The package communicates with a domain associated with malicious activity...