Malicious code in videoads-util-capability-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c35439ff6a52f61168d44df9518ac3ee4b0165f2e3e6b8e748d90d105e1c3d27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in videoads-util-capability-detection

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-7605: Missing Authorization

The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'haajax' function in all versions up to, and including, 1.1.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to update...

CVE-2024-7380: Missing Authorization

The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajaxgeolocatemenu and ajaxgeolocateremovemenu functions in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with...

CVE-2024-6332: Missing Authorization

The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function in all versions up to, and including, Premium 7.7 and Lite 1.2.4. This makes it...

CVE-2024-5309: Missing Authorization

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fvexportcsv, resetsettings, savesettings, savecolumnssettings, getanalyticsdata, geteventlogsdata, deletesubmissions, and...

PT-2024-35553

Name of the Vulnerable Software and Affected Versions The Form Vibes – Database Manager for Forms plugin for WordPress versions up to, and including, 1.4.12 Description The issue allows unauthorized access and modification of data due to a missing capability check on several functions, including ...

PT-2024-38446 · WordPress · Helloasso

Name of the Vulnerable Software and Affected Versions: HelloAsso plugin for WordPress versions up to, and including, 1.1.10 Description: The issue allows authenticated attackers with Contributor-level access and above to update plugin options, potentially disrupting the service, due to a missing...

PT-2024-38310 · WordPress · Geo Controller

Name of the Vulnerable Software and Affected Versions: Geo Controller plugin for WordPress versions up to, and including, 8.6.9 Description: The issue arises from missing capability checks on the ajax geolocate menu and ajax geolocate remove menu functions, allowing authenticated attackers with...

PT-2024-37547 · Google · Google Calendar

Name of the Vulnerable Software and Affected Versions: Amelia Premium versions up to 7.7 Amelia Lite versions up to 1.2.3 Description: The issue is related to a missing capability check on the ameliaButtonCommand function, allowing unauthenticated attackers to access employee calendar details. In...

CVE-2024-44948

In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the...

DEBIAN-CVE-2024-44948

In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the...

UBUNTU-CVE-2024-44948

In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the...

CVE-2024-44948 x86/mtrr: Check if fixed MTRRs exist before saving them

In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the...

CVE-2024-44948

In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the...

CVE-2024-8289

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the updateitempermissionscheck and createitempermissionscheck functions in all...

CVE-2024-8289 MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the updateitempermissionscheck and createitempermissionscheck functions in all...

CVE-2024-8289

CVE-2024-8289 affects the WordPress plugin “MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution” (versions

CVE-2024-8289 MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the updateitempermissionscheck and createitempermissionscheck functions in all...

CVE-2024-8121

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpextchangeadminname function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, wi...