10971 matches found
CVE-2025-24982
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted...
CVE-2025-24982
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted...
CVE-2025-24982
The CVE-2025-24982 affects the WordPress plugin Activity Log WinterLock, specifically versions prior to 1.2.5. The vulnerability is a Cross‑Site Request Forgery (CSRF) that can cause log data to be deleted when a logged‑in user views a malicious page. No root cause details beyond CSRF are provide...
WordPress plugin Activity Log WinterLock: Cross-site Request Forgery vulnerability
WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists ...
JVN#94806805: WordPress Plugin "Activity Log WinterLock" vulnerable to cross-site request forgery
WordPress Plugin "Activity Log WinterLock" provided by SWIT contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, the log data may be deleted. Solution Update the plugin Update the plugin according to the information provided by the...
CVE-2025-24982: Cross-Site Request Forgery (CSRF)
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted...
CVE-2024-53266: Improper Neutralization of Input During Web Page Generation
Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to...
Discourse cross-site scripting vulnerabilities
Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from the fact that the activity stream in a user's profile page may be...
PT-2025-2952
Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version of Discourse core Description Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the...
CVE-2025-22918
creationtimestamp| type| source ---|---|--- 2025-02-03 21:15:53+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhchmvhxug2f 2025-02-03 22:08:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lhckkqqmmb2g 2025-02-03 23:41:03+00:00| seen|...
Malicious code in invalid-dependency (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in fitbit-widget-dropdown (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-1013 Malicious code in apple-sdk (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4113cf662e414936dfc540b2ebc7c134b8d83e46635daadf59a0105f86c70feb Any computer that has this package installed or running should be considered...
MAL-2025-1031 Malicious code in cg-be-package (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in cg-be-package (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-1037 Malicious code in guests (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90c450f222886a91d7c733fcfbdf4a4b5104c0b4a1d1931f79e0bea1201f1398 Any computer that has this package installed or running should be considered...
Malicious code in cth-poc (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-1212 Malicious code in cth-poc (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-1228 Malicious code in precompiled-iris300 (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2fc49c5f492a6603e16701144ee66fabcdea41176b445eb496c8e9d11caccd4 Any computer that has this package installed or running should be considered...