MAL-2023-1191 Malicious code in grabathon-4.0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63f79f14ebf843fdb684a6c8fb1c92c4bd5f60701a7fc98c0b95584b249a8438 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1299 Malicious code in snew-classic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0ac296eeaba98c7d28c3be79bec7f5ca26b13e1b576956695d24f12d232f7c89 The OpenSSF Package Analysis project identified 'snew-classic-ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in snew-classic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0ac296eeaba98c7d28c3be79bec7f5ca26b13e1b576956695d24f12d232f7c89 The OpenSSF Package Analysis project identified 'snew-classic-ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Datalogics Library Third-Party

1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION: Low attack complexity Vendor: Datalogics Equipment: Library APDFL v18.0.4PlusP1e Vulnerability: Stack-based buffer overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to crash the device. 3. TECHNICAL...

CVE-2023-33492

creationtimestamp| type| source ---|---|--- 2023-06-12 16:39:55+00:00| seen| https://t.me/cibsecurity/65132...

CVE-2021-45839

creationtimestamp| type| source ---|---|--- 2023-06-09 17:46:16+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/terramasterunauthrcecve202145837.rb 2025-02-06 03:13:45+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23...

CVE-2023-2286

The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajaxruncleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged...

CVE-2023-2285

The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajaxswitchdb function. This makes it possible for unauthenticated attackers to make changes to the...

CVE-2023-2284

The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxswitchdb function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make...

CVE-2023-2261

The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handleajaxcall function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with subscriber-level access or higher, to obtain a list of...

Authorization

The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handleajaxcall function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with subscriber-level access or higher, to obtain a list of...

Cross site request forgery (csrf)

The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajaxswitchdb function. This makes it possible for unauthenticated attackers to make changes to the...

Design/Logic Flaw

The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxswitchdb function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make...

Cross site request forgery (csrf)

The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajaxruncleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged...

CVE-2023-2261 WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration

The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handleajaxcall function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with subscriber-level access or higher, to obtain a list of...

CVE-2023-2261

CVE-2023-2261 ffects the WordPress plugin WP Activity Log. The vulnerability is an authorization bypass caused by a missing capability check in the handle_ajax_call function, exposed in versions up to and including 4.5.0. This allows authenticated users with subscriber-level access or higher to e...

CVE-2023-2284

CVE-2023-2284 (and related 2285) affects the WP Activity Log Premium plugin for WordPress. The issue is an unauthorized modification of data caused by a missing capability check in the ajax_switch_db function, affecting versions up to 4.5.0. Authenticated users with subscriber-level privileges or...

CVE-2023-2286 WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup

The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajaxruncleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged...

CVE-2023-2286

Modes: C. The CVE-2023-2286 entry concerns the WP Activity Log for WordPress. The connected Red Hat and Wordfence-derived records confirm a CSRF vulnerability in the WP Activity Log (and WP Activity Log Premium) up to version 4.5.0, caused by missing/incorrect nonce validation in the ajax_run_cle...

CVE-2023-2284 WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_db

The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxswitchdb function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make...