MAL-2025-69 Malicious code in marked-cs (npm)

This package deploys Windows gh0strat malware via VBScript --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f49714fc5f2d734162fbcc4c7c4552ec6d6e89b81109ba8652c3d057686022 Any computer that has this package installed or running should be considered fully compromised...

CVE-2024-11770: Improper Neutralization of Input During Web Page Generation

The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-16920

Name of the Vulnerable Software and Affected Versions Clickbank WordPress Plugin Storefront versions up to, and including, 1.7 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation via the cs menu page. This allows unauthenticated attackers to...

CVE-2024-54210: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codexshaper Advanced Element Bucket Addons for Elementor cs-element-bucket allows Stored XSS.This issue affects Advanced Element Bucket Addons for Elementor: from n/a through = 1.0.2...

kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

A vulnerability was found in the Linux kernel in the csdsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an...

kernel: firmware: cs_dsp: Validate payload length before processing block

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...

Malicious code in cs-shared-component-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7b8d8fe1019a5e94c13232a7501bb7dc77b9f34c4b2c02354edfc3ab84d27f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in cs-deploy-helper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in cs-shared-component-tools

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in cs-base-component

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-10958 Malicious code in cs-shared-component-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7b8d8fe1019a5e94c13232a7501bb7dc77b9f34c4b2c02354edfc3ab84d27f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin Chessgame Shizzle 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-16999 · WordPress · Chessgame Shizzle

Name of the Vulnerable Software and Affected Versions: The Chessgame Shizzle plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated...

PT-2024-16966

Name of the Vulnerable Software and Affected Versions The Grid View Gallery plugin for WordPress versions up to, and including, 1.0 Description The issue allows authenticated attackers with Editor-level access and above to inject a PHP Object via deserialization of untrusted input from the cs all...

UBUNTU-CVE-2023-52921

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix possible UAF in amdgpucspass1 Since the gangsize check is outside of chunk parsing loop, we need to reset i before we free the chunk data. Suggested by Ye Zhang @VAR10CK of Baidu Security...

kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

A vulnerability was found in the Linux kernel in the csdsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an...

kernel: firmware: cs_dsp: Return error if block header overflows file

A denial of service vulnerability was found in the Linux kernel. No error was returned from the csdsppowerup function if a block header is longer than the amount of data left in the file...

kernel: ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/csdspctl: Use privatefree for control cleanup Use the control privatefree callback to free the associated data block. This ensures that the memory won't leak, whatever way the control gets destroyed. The original...

kernel: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance

A flaw was found in the Linux kernel's HDA driver before initialization. This issue occurs when a user unloads and then reloads the module, and could allow a local user to crash the system...

kernel: firmware: cs_dsp: Validate payload length before processing block

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...