9372 matches found
Malicious Package
Overview tempomati-omega-5-emcuf311 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...
Malicious Package
Overview @skinternal/sk-logger is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
FlatPress security vulnerability
FlatPress is a Php-based blog builder without database support from the FlatPress community. A security vulnerability exists in FlatPress versions prior to 1.3. An attacker exploited the vulnerability to change file names or file paths...
FlatPress cross-site scripting vulnerabilities
FlatPress is a Php-based blog builder without database support from the FlatPress community. A cross-site scripting vulnerability exists in FlatPress versions prior to 1.3. An attacker can exploit this vulnerability to perform cross-site scripting attacks...
Cross-site Scripting (XSS)
moodle/moodle is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the bloggetheaders function of lib.php due to insufficient sanitization of user-supplied data in the blog search functionality which allows a remote attacker to trick the victim to follow a specially crafted link...
Friday Squid Blogging: Squid Processing Facility
This video of a modern large squid processing ship is a bit gory, but also interesting. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...
Unrestricted file upload
File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page...
CVE-2021-35290
CVE-2021-35290 is a file upload vulnerability in balerocms-src 0.8.3 that allows remote code execution via the rich text editor on the /admin/main/mod-blog page. Connected sources confirm the affected software and the root cause (unrestricted upload through the editor). Practical impact is arbitr...
CVE-2021-35290
File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page...
CVE-2021-35290: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page...
balerocms-src code issues and vulnerabilities
balerocms-src is the source code for Balero CMS. A security vulnerability exists in balerocms-src version 0.8.3, which originates from a vulnerability that allows remote attackers to run arbitrary code via a rich text editor on the /admin/main/mod-blog page...
PT-2023-12257 · Unknown · Balerocms-Src
Name of the Vulnerable Software and Affected Versions: balerocms-src version 0.8.3 Description: The issue allows remote attackers to run arbitrary code via a rich text editor on the "/admin/main/mod-blog" page. This is a result of a File Upload vulnerability. Recommendations: For balerocms-src...
GeoServer OGC Filter SQL Injection Vulnerabilities
Impact GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is also supported through the Web Coverage Service WCS protocol for ImageMosaic coverages. SQL Injection...
Malicious Package
Overview @geocomponents/hooks is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
Malicious Package
Overview yb-frontend-utils is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...
Malicious Package
Overview tanker-pilot is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Malicious Package
Overview yasap-gulp-dev-tools is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
Malicious Package
Overview yandex-dch-up is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
