WordPress Modern Events Calendar Lite Plugin < 6.4.0 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.126054";...

kernel: race condition in perf_event_open leads to privilege escalation

A use-after-free flaw was found in the Linux kernel’s performance events functionality. A user triggers a race condition in setting up performance monitoring between the leading PERFTYPETRACEPOINT and sub PERFEVENTHARDWARE plus the PERFEVENTSOFTWARE using the perfeventopen function with these thr...

kernel: race condition in perf_event_open leads to privilege escalation

A use-after-free flaw was found in the Linux kernel’s performance events functionality. A user triggers a race condition in setting up performance monitoring between the leading PERFTYPETRACEPOINT and sub PERFEVENTHARDWARE plus the PERFEVENTSOFTWARE using the perfeventopen function with these thr...

CMC Electronics EFB breakout vulnerability

We’ve been finding vulnerabilities in electronic flight bags for a few years now. Disclosure response from the vendors involved has varied from excellent to radio silence. In every case we have tried extremely hard to engage with the vendors involved, even where we were ignored. We asked friendly...

Zulip logic error vulnerability

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. A logic error vulnerability exists in Zulip versions 2.1.0 through 5.2, which originates when the server incorrectl...

initiateBuyout and sell functions on NibbleVault.sol Reentrancy vulnerability

Lines of code Vulnerability details Impact 1. In NibbleVault.sol, it is possible for a contract to prevent the Sell event from being fired after being sent ether. From calling the sell function on line 390, an attacker contract is able to keep the event hidden from being listened to by stopping t...

WordPress Events Made Easy plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress Events Made Easy plugin prior to 2.2.81 are vulnerable to SQL injection...

SharpSniper - Find Specific Users In Active Directory Via Their Username And Logon IP Address

Often a Red Team engagement is more than just achieving Domain Admin. Some clients will want to see if specific users in the domain can be compromised, for example the CEO. SharpSniper is a simple tool to find the IP address of these users so that you can target their box. It requires that you ha...

Malicious code in wix-events-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2c8042b735fab012588f30c2f58b93feeda458483e6bbf0bfffb5694a59a258 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7166 Malicious code in wix-events-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2c8042b735fab012588f30c2f58b93feeda458483e6bbf0bfffb5694a59a258 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-438 Malicious code in @msmg/gtm-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5755beca6bf1d5544c49f75ca17d6094c45ade4dc924cd8fb8adddeef176f4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zipmex/events-stream-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b626ed2ba8317a3c709a45a9d17f5ef193b73c0b157c6dc10c88a6c9a08cc513 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-794 Malicious code in @zipmex/events-stream-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b626ed2ba8317a3c709a45a9d17f5ef193b73c0b157c6dc10c88a6c9a08cc513 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5903 Malicious code in saddlebag-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b79d0c3bb9fae6342530e283bd532f6b617aaa81129ee8ac048fee3f8411c2d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in saddlebag-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b79d0c3bb9fae6342530e283bd532f6b617aaa81129ee8ac048fee3f8411c2d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-Site Scripting (XSS)

brotkrueml/typo3-matomo-integration is vulnerable to cross-site scripting. The vulnerability exists in convertStringValue function in MatomoMethodCall.php because the content from PSR-14 events are not properly escaped which allows an attackers to inject and execute arbitrary javascript...

CVE-2022-1905

The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2022-1905

The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2022-1905

The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2022-1905

The CVE-2022-1905 entry documents an SQL injection in the WordPress plugin “Events Made Easy” before version 2.2.81. The vulnerability arises from improper sanitisation and escaping of a parameter used in a SQL statement via an unauthenticated AJAX action, allowing an attacker to inject SQL. The ...