Malicious Package

Overview stripe-demo-connect-standard-saas-platform is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only...

Malicious Package

Overview machine-mapper is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

WordPress WP DS Blog Map plugin <= 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Vinay Varma Mudunuri, Krishna Harsha Kondaveeti in WordPress WP DS Blog Map plugin versions = 3.1.3. Solution Deactivate and delete. This plugin has been closed as of July 15, 2022 and is not available for download. This...

WP DS Blog Map <= 3.1.3 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in any of the settings...

WP DS Blog Map <= 3.1.3 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in any of the settings...

Cross site request forgery (csrf)

The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog options like defaultrole, userscanregister via a CSRF attack...

Malicious Package

Overview sushiswap-analytics is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

Malicious Package

Overview deere-ui-domain-framework-mixins is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable ...

CVE-2022-2144: Cross-Site Request Forgery (CSRF)

The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog options like defaultrole, userscanregister via a CSRF attack...

WordPress Plugin Best Contact Management: Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site request forgery...

PT-2022-14956

Name of the Vulnerable Software and Affected Versions Jquery Validation For Contact Form 7 WordPress plugin versions prior to 5.3 Description The issue is related to the lack of a CSRF check when updating the plugin's settings. This could allow attackers to make a logged-in admin change blog...

Friday Squid Blogging: Squid Inks Fisherman

Short video. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

Malicious Package

Overview patrick-test2 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

CVE-2022-30517

Mogu blog 5.2 is vulnerable to Cross Site Scripting XSS...

CVE-2022-30517

Mogu blog 5.2 is vulnerable to Cross Site Scripting XSS...

Cross site scripting

Mogu blog 5.2 is vulnerable to Cross Site Scripting XSS...

CVE-2022-30517

Mogu blog 5.2 is vulnerable to Cross Site Scripting XSS...

CVE-2022-30517

Mogu blog 5.2 is vulnerable to Cross Site Scripting XSS...

CVE-2022-30517

Mogu blog 5.2 is vulnerable to Cross Site Scripting XSS...

CVE-2022-30517

Affected software: Mogu blog 5.2. The CVE-2022-30517 entry relates to a Cross Site Scripting (XSS) vulnerability. A connected document (CNNVD-202207-1188) provides a concrete technical detail: the issue stems from the upload handling, where the format of user uploads is not strictly verified and ...