Malicious code in sling-calendar-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9450d991ed470df2b266a03b33a83ee5953186a21b328b837398a8a2af69d421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in sling-calendar-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-11006 Malicious code in sling-calendar-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9450d991ed470df2b266a03b33a83ee5953186a21b328b837398a8a2af69d421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Sugar Calendar (Lite) plugin <= 3.3.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Sugar Calendar Lite versions = 3.3.0...

CVE-2024-10878

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attacker...

CVE-2024-10878

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attacker...

CVE-2024-10878 Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attacker...

CVE-2024-10878 Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attacker...

CVE-2024-10878

CVE-2024-10878 affects the WordPress plugin Sugar Calendar – Lite (Sugar Calendar) up to version 3.3.0 . The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by improper escaping in the URL through the use of add_query_arg and remove_query_arg . This allows unauthenticated attackers...

CVE-2024-9504

CVE-2024-9504 affects the Booking calendar, Appointment Booking System plugin for WordPress, with an unauthenticated stored XSS via SVG uploads in versions up to 3.2.15 caused by inadequate input sanitization and output escaping. The vulnerability permits injection of script code that executes wh...

CVE-2024-9504 Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-10729

CVE-2024-10729 affects Booking & Appointment Plugin for WooCommerce for WordPress (versions up to and including 6.9.0). Root cause: missing capability check in the save_google_calendar_data function, allowing authenticated users with subscriber-level permissions or higher to arbitrarily update si...

PT-2024-16611 · WordPress · Sugar Calendar

Name of the Vulnerable Software and Affected Versions: Sugar Calendar – Simple Event Management plugin for WordPress versions prior to 3.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without proper escaping on the URL...

WordPress Sugar Calendar (Lite) Plugin <= 3.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Sugar Calendar Lite Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.4.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10878 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8ef7ef64f31f Credits Peter Thaleik...

WordPress plugin Sugar Calendar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-16491 · Woocommerce · Booking & Appointment Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: Booking & Appointment Plugin for WooCommerce version 6.9.0 and earlier Description: The issue is related to a missing capability check in the save google calendar data function, allowing authenticated attackers with subscriber-level permissio...

WordPress plugin Booking calendar, Appointment Booking System 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. WordPress plugin Booking calendar,...

CVE-2024-10878: Improper Neutralization of Input During Web Page Generation

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attacker...

CVE-2024-9504: Unrestricted Upload of File with Dangerous Type

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2024-39665 · WordPress · Booking Calendar

Name of the Vulnerable Software and Affected Versions: The Booking calendar, Appointment Booking System plugin for WordPress versions up to, and including, 3.2.15 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and outpu...