MAL-2022-6835 Malicious code in usaa-css-grids (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b114773123a89d4d00f86e30e996e132fd45058c3d5d186d3f59e8cd303f7fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in feast-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9020fe08dcbac061c9250afcb7701400417ae8dcde091ca3474f8b54a8ad8cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-retina-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ed83103eb9e61c845a6b73a155a856ed96db758a8686c6870435465a579676c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3479 Malicious code in grunt-retina-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ed83103eb9e61c845a6b73a155a856ed96db758a8686c6870435465a579676c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in scale-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fb2cb0dd597cbe85b6778b2a375cb19f30f3e468e0e9876e476f6e8db9bf5cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5957 Malicious code in scale-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fb2cb0dd597cbe85b6778b2a375cb19f30f3e468e0e9876e476f6e8db9bf5cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in scale-css-loaderx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8cd7ab267b463eac2a358a63661972431325d7095e7085f03e9690e6743a3699 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fitbit-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6212daf71fae3c165b5999556ea9f8e25fb08b5d0e5beb46b543b50ddf56c46b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3059 Malicious code in fitbit-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6212daf71fae3c165b5999556ea9f8e25fb08b5d0e5beb46b543b50ddf56c46b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in external-js-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c06d2f4db7e9efc9676f195c4794c9b02fb52e277ad85db8059db8803081e15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2940 Malicious code in external-js-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c06d2f4db7e9efc9676f195c4794c9b02fb52e277ad85db8059db8803081e15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UI REDRESSING

Description Clickjacking is a portmanteau of two words ‘click’ and ‘hijacking’. It refers to hijacking user’s click for malicious intent. In it, an attacker embeds the vulnerable site in an transparent iframe in attacker’s own website and overlays it with objects such as button using CSS skills...

CVE-2022-29257

Summary: CVE-2022-29257 affects Electron up to version 18.0.0-beta.6 (and older 17.2.0, 16.2.6, 15.5.5). If an attacker controls a victim app’s update server/storage, they can serve update packages that pass code signing validation but run malicious code in some components. The vulnerability aris...

CVE-2022-29257 Electron's AutoUpdater module fails to validate certain nested components of the bundle

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafte...

CVE-2022-29247

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...

CVE-2022-29247

CVE-2022-29247 — Electron IPC leakage via nodeIntegrationInSubFrames . The issue affects Electron versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5. A renderer with JS execution can gain access to a new renderer process when nodeIntegrationInSubFrames is enabled, which can expose access...

CVE-2022-29247 Exposure of Resource to Wrong Sphere in Electron

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...

Cross-site Scripting (XSS)

firefox is vulnerable to cross site scripting. The vulnerability exists due to a lack of sanitization of URI in CSS stylesheets allowing an attacker to inject maliciously crafted script into the system...

Nextcloud: Unauthenticated SSRF in 3rd party module "cerdic/csstidy"

Summary: The mail extension in nextcloud includes a module called "cerdic/csstidy" which basically ships with a publicly accessible test/example interface to play with the CSS formatter and optimiser /apps/mail/vendor/cerdic/css-tidy/cssoptimiser.php. This module allows contacting any remote serv...

Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack "...