MAL-2024-10656 Malicious code in eslint-plugin-add-display-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8efa7275ffd4613db923c31dba516fc3434fb3fecb4ccfbd1e1cb929399a6b02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-add-display-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8efa7275ffd4613db923c31dba516fc3434fb3fecb4ccfbd1e1cb929399a6b02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update for go1.21-openssl

This update for go1.21-openssl fixes the following issues: CVE-2024-24791: Fixed denial of service due to improper 100-continue handling bsc1227314 CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973 CVE-2024-24790: Fixed unexpected behavior from Is...

golang: net/mail: comments in display names are incorrectly handled

A flaw was found in Go's net/mail standard library package. The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions made by programs using...

WordPress plugin WP ULike 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-37866 · WordPress · Wp Ulike

Name of the Vulnerable Software and Affected Versions: WP ULike versions prior to 4.7.2.1 Description: The issue arises from the WP ULike WordPress plugin's failure to properly sanitize user display names when rendering them on a public page. This can lead to potential security risks, including t...

GHSA-Q765-WM9J-66QJ @blakeembrey/template vulnerable to code injection when attacker controls template input

Impact It is possible to inject and run code within the template if the attacker has access to write the template name. js const template = require'@blakeembrey/template'; template"Hello name!", "exploit && = console.log'success'; && function pwned"; Patches Upgrade to 1.2.0. Workarounds Don't pa...

@blakeembrey/template vulnerable to code injection when attacker controls template input

Impact It is possible to inject and run code within the template if the attacker has access to write the template name. js const template = require'@blakeembrey/template'; template"Hello name!", "exploit && = console.log'success'; && function pwned"; Patches Upgrade to 1.2.0. Workarounds Don't pa...

CVE-2024-45390

The CVE-2024-45390 entry concerns the @blakeembrey/template string template library. Prior to version 1.2.0, there is a vulnerability where an attacker who can write the template name can inject and run code within the template. A patch was included in version 1.2.0. Remediation guidance from the...

PT-2024-31594 · Npm · @Blakeembrey/Template

Name of the Vulnerable Software and Affected Versions: @blakeembrey/template versions prior to 1.2.0 Description: The issue allows an attacker to inject and run code within the template if they have access to write the template name. This can be achieved by exploiting the template display name...

USN-6886-1 golang-1.21, golang-1.22 vulnerabilities

It was discovered that the Go net/http module did not properly handle the requests when request's headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic resulting into a denial of service. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS...

golang: net/mail: comments in display names are incorrectly handled

A flaw was found in Go's net/mail standard library package. The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions made by programs using...

golang: net/mail: comments in display names are incorrectly handled

A flaw was found in Go's net/mail standard library package. The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions made by programs using...

CVE-2024-1766

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acces...

CVE-2024-1766

The CVE-2024-1766 is a Stored Cross-Site Scripting vulnerability in the WordPress Download Manager plugin (versions

PT-2024-18287 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.2.86 Description: The issue is related to Stored Cross-Site Scripting via a user's Display Name due to insufficient input sanitization and output escaping. This allows...

golang: net/mail: comments in display names are incorrectly handled

A flaw was found in Go's net/mail standard library package. The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions made by programs using...

CVE-2024-4984 Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘displayname’ author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

PT-2024-33699 · Yoast · Yoast Seo

Name of the Vulnerable Software and Affected Versions: Yoast SEO plugin for WordPress versions up to, and including, 22.6 Description: The issue is related to Stored Cross-Site Scripting via the display name author meta due to insufficient input sanitization and output escaping. This allows...

CVE-2024-23186

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer...