4784 matches found
Malicious code in fadam-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 02e81c60df4cba570ba561c45c4e1f48fe798f16078ef1a7c2c601cdb3edf1f7 The OpenSSF Package Analysis project identified 'fadam-frontend' @ 101.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2023-8406 Malicious code in fadam-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 02e81c60df4cba570ba561c45c4e1f48fe798f16078ef1a7c2c601cdb3edf1f7 The OpenSSF Package Analysis project identified 'fadam-frontend' @ 101.0.0 npm as malicious. It is considered malicious because: - The package...
Code injection
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...
CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...
CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...
Cross site scripting
Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected authcallback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is...
CVE-2023-41896 Fake websocket server installation permits full takeover in Home Assistant Core
Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected authcallback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is...
PT-2023-7041
Name of the Vulnerable Software and Affected Versions Squid affected versions not specified Description The issue is related to the chunked decoder of the Squid proxy server, which is associated with the server's interpretation of fragmented syntax encoding. This can allow a remote attacker to...
Ninja Forms < 3.6.34 - Admin+ Stored XSS
Description The plugin does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfilteredhtml capability can perform this, and such users are already allowed to use JS in posts/comments etc however the...
[SECURITY] Fedora 38 Update: cacti-1.2.25-1.fc38
Cacti is a complete frontend to RRDTool. It stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven...
[SECURITY] Fedora 37 Update: cacti-1.2.25-1.fc37
Cacti is a complete frontend to RRDTool. It stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven...
Malicious code in @homelte_dev/frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f2d02301268cfef4a6a2de3fb9e7e323b5de41a41a17af9056a056400d6c41b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Zabbix Security Vulnerabilities
Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A security vulnerability exists in Zabbix that stems from A server request forgery SSRF vulnerability exists in the Frontend component...
Photos and Files Contest Gallery – Contact Form < 21.2.8.1 - Unauthenticated Stored XSS via HTTP Headers
Description The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers. 1. Use a proxy such as BurpSuite to add the following header to all requests: X-Forwarded-For: 11.11.11.11 2. Create a gallery...
WP Meta and Date Remover < 2.2.0 - Subscriber+ Stored XSS
Description The plugin provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site...
Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting
Description The plugin does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup. 1. Create a new PopUp Box within the plugi...
Improper Access Control
femanager is vulnerable to Improper Access Control. The vulnerability is due to a lack of proper access control checks in the plugin, allowing a remote user to create frontend user accounts with unauthorized access to configured frontend groups...
GHSA-93J4-V838-8767 TYPO3 extension femanager Broken Access Control vulnerability
femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups...
WordPress WP User Frontend Plugin <= 3.6.8 is vulnerable to Broken Access Control
Software WP User Frontend Type Plugin Vulnerable versions = 3.6.8 Fixed in 3.6.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-45002 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bd6150300c70 Credits Abdi Pranata Required...