Malicious code in @logistics-frontend/ndd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware affdd33b3ef985c7a2234ece7c7196fe737cc2a6bf9262d955b9ac46d7b57222 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @logistics-frontend/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c1071ed352739aa34ab8907b99ce3d1e2e3127a96d8d63b155f3830fd9d8b44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-396 Malicious code in @logistics-frontend/polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f64b2f1ddf3127537e8c1840e3435d7ff1cbe9db0ed322bcf357600faace765 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @logistics-frontend/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2c617a6d61a62b6cadd5b810e4ef2ff8ab74e499dfe400bd5294f7b88e2a09c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-390 Malicious code in @logistics-frontend/blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb407e89990bc6a460beeb330789292665ada7885bd91e2013e25ca373b54e4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @logistics-frontend/client-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ec68c4d34cf87350cff78bf89af4256fe327563a079c07c24cc75114db204ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @logistics-frontend/ui-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7cc04546f7a02c1213fb1a79c340b46c59bfdbd8b0a7e17438194fe8b90e7d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-391 Malicious code in @logistics-frontend/client-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ec68c4d34cf87350cff78bf89af4256fe327563a079c07c24cc75114db204ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-399 Malicious code in @logistics-frontend/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2c617a6d61a62b6cadd5b810e4ef2ff8ab74e499dfe400bd5294f7b88e2a09c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Print, PDF, Email by PrintFriendly < 5.2.3 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed In the plugin's settings, tick 'Custom Button' and put the following payload ...

GHSA-9H7F-5HC8-CJ5F Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module

Cross-site scripting XSS vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the keywords parameter...

Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module

Cross-site scripting XSS vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the keywords parameter...

Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module

Cross-site scripting XSS vulnerability in the Frontend JS module before version 4.0.18, in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a...

GHSA-HGJV-7WJR-QWQP Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module

Cross-site scripting XSS vulnerability in the Frontend JS module before version 4.0.18, in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a...

GHSA-J2W4-45QM-R674 direct_mail for Typo3 sensitive data exposure

The directmail aka Direct Mail extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user with restricted permissions to the feusers table to view and export data of frontend users who are subscribed to a newsletter...

direct_mail for Typo3 sensitive data exposure

The directmail aka Direct Mail extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user with restricted permissions to the feusers table to view and export data of frontend users who are subscribed to a newsletter...

Sideblog <= 6.0 - Arbitrary Settings Update via CSRF to Stored XSS

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping " document.getElementById"test".submit; The XSS will be...

GHSA-V6XV-RMQC-WCC8 Typo3 Open Redirect In Frontend Rendering

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains. An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that...

Typo3 Open Redirect In Frontend Rendering

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains. An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that...

ForkCMS Directory Traversal vulnerability

Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. dot dot in the module parameter to frontend/js.php...