admin-tool-button (>=1.0.1a0 <=1.0.5a0), aimmo (>=2.0.0 <=2.4.0) +87 more potentially affected by CVE-2022-34265 via django (>=3.2.0 <=3.2.13)

django PYPI version =3.2.0, =1.0.1a0, =2.0.0, =0.2.0, =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =6.0.0, =6.0.0, =1.1.0, =1.1.1 - common-framework =2021.4.1 - directory-constants =21.3.0 and more Source cves: CVE-2022-34265 Source advisory: OSV:GHSA-P64X-8RXX-WF6Q...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), aimmo (>=2.0.0 <=2.4.0) +87 more potentially affected by CVE-2022-34265 via django (>=3.2.0 <=3.2.13)

django PYPI version =3.2.0, =1.0.1a0, =2.0.0, =0.2.0, =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =6.0.0, =6.0.0, =1.1.0, =1.1.1 - common-framework =2021.4.1 - directory-constants =21.3.0 and more Source cves: CVE-2022-34265 Source advisory: OSV:PYSEC-2022-213...

Name Directory < 1.25.3 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well alert/XSS/" /...

Toll fraud malware: How an Android application can drain your wallet

Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve. Compared to other subcategories of billing fraud, which...

Joy ebike Wolf 安全漏洞

Joy ebike Wolf is an electric scooter from Joy ebike India. A security vulnerability exists in Joy ebike Wolf Manufacturing. A remote attacker could exploit the vulnerability to deny the vehicle lock button and remain unlocked...

Jenkins Cross-Site Scripting Vulnerability (CNVD-2022-65927)

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins versions 2.340 through 2.355 contain a cross-site scripting vulnerability that stems from the tooling of the build...

GHSA-6G4R-Q7QG-6QX6 Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.340, the tooltip of the build button in list views supports HTML without escaping the job display name. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356 addresses this vulnerability. The tooltip of the build button in list vie...

CVE-2022-34173

In Jenkins 2.340 through 2.355 both inclusive the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

Jenkins 跨站脚本漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins versions 2.340 through 2.355 contain a cross-site scripting vulnerability that stems from the tooling of the build...

PT-2022-22040 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.340 through 2.355 Description: The tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting XSS vulnerability. This issue is exploitable by attackers...

Malicious code in mitui-comp-follow-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ec2258f4ac3890208ab0a86cfa7870e80a344822c1754abc483caa4d7aede97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4622 Malicious code in mitui-comp-follow-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ec2258f4ac3890208ab0a86cfa7870e80a344822c1754abc483caa4d7aede97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-308 Malicious code in @harrysforge/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0ad11572f55c827262447cd0c1170bceee7eb0e9dc4feb1e492ce378725f5d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @harrysforge/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0ad11572f55c827262447cd0c1170bceee7eb0e9dc4feb1e492ce378725f5d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1733 Malicious code in buy-button-storefront (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e4b8b996702ddd85ace1d3199b515bf69d94da28c2ef23e096944093eaaa46b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in buy-button-storefront (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e4b8b996702ddd85ace1d3199b515bf69d94da28c2ef23e096944093eaaa46b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in brock-react-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e5501b5519eb60173c8b4749356fa44ebfa4755d907ce53f9e0c7a2c491ff8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-0663

The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0663

The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress Button Widget Smartsoft plugin <= 1.0.1 - Cross-Site Request Forgery (CSRF) vulnerability to Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability to Cross-Site Scripting XSS was discovered by Ryo Onodera Cryptography Laboratory Tokyo Denki University in the WordPress Button Widget Smartsoft plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of June 8, 2022 a...