Mesmerize Companion < 1.6.135 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC Required...

WPQA < 5.9.3 - Missing validation lead to functionality abuse

The plugin which is a companion plugin used with Discy and Himer themes incorrectly tries to validate that a user already follows another in the wpqafollowingyouajax action, allowing a user to inflate their score on the site by having another user send repeated follow actions to them. PoC...

CVE-2022-20266

In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed fo...

CVE-2022-20266

In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed fo...

Input validation

In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed fo...

Google Android 输入验证错误漏洞

Google Android is a Linux-based open-source operating system from Google, Inc. A security vulnerability exists in the Google Android Companion component, which stems from a possible way to make a service run with higher importance without displaying a foreground service notification due to improp...

CVE-2022-20266

In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed fo...

CVE-2022-20266

In CVE-2022-20266, the Android 13 Companion component is affected by improper input validation that can allow a service to run with elevated importance without showing a foreground service notification. This enables local elevation of privilege and requires user interaction to exploit; no extra e...

PT-2022-14489 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to improper input validation in the Companion service, allowing it to run with elevated importance without displaying a foreground service notification. This could...

flipper-server (>=0.171.1, <=0.212.0), flipper-server-core (>=0.171.1, <=0.212.0) potentially affected by unknown CVE via flipper-server-companion (>=0.171.1, <=0.212.0)

flipper-server-companion NPM version =0.171.1, =0.171.1, =0.171.1, =0.212.0 Source cves: unknown CVE Source advisory: OSV:MAL-2022-3077...

Malicious Package

Overview flipper-server-companion is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

CVE-2022-1597

The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks...

HCL Technologies Traveler Companion Cross-Site Scripting Vulnerability

HCL Technologies Traveler Companion is an ios Iphone and Ipad application from HCL Technologies, India. It is used to read encrypted Hcl Notes emails on Apple devices.A cross-site scripting vulnerability exists in HCL Technologies Traveler Companion version 12.0.1.0 and earlier, which stems from...

HCL Technologies Traveler Companion 跨站脚本漏洞

HCL Technologies Traveler Companion is an ios Iphone and Ipad application from HCL Technologies, India. It is used to read encrypted Hcl Notes emails on Apple devices.A cross-site scripting vulnerability exists in HCL Technologies Traveler Companion version 12.0.1.0 and earlier, which stems from...

Researcher Spotlight: Hector Peralta’s Evolution from Popcorn Server to the MSRC Leaderboards

“The bug bounty literally changed my life. Before this, I had nothing.” Coolest thing he purchased : His first vehicle! Best gift to give: Buying his nephew gaming accessories. Favorite Hacking Companion : His two cats. They’re always by his side when he is working late. Origin of his Hacker name...

WordPress Blocksy Companion plugin < 1.8.20 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Blocksy Companion plugin versions 1.8.20. Solution Update the WordPress Blocksy Companion plugin to the latest available version at least 1.8.20...

WordPress SV100 Companion plugin < 1.8.12 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress SV100 Companion plugin versions 1.8.12. Solution Update the WordPress SV100 Companion plugin to the latest available version at least 1.8.12...

WordPress Blocksy Companion plugin < 1.8.20 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Blocksy Companion plugin versions 1.8.20. Solution Update the WordPress Blocksy Companion plugin to the latest available version at least 1.8.20...

WordPress SV100 Companion plugin < 1.8.12 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SV100 Companion plugin versions 1.8.12. Solution Update the WordPress SV100 Companion plugin to the latest available version at least 1.8.12...

lib60870代码问题漏洞

lib60870 is a C language library based on the IEC60870-5 protocol. The library provides support for CompanionStandard 101 CS101 and 104 CS104 of the IEC family of standards for remote control applications IEC60870-5 and is commonly used in power systems for communication between central station...