PT-2022-23959 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.2.1.53537 Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this issue, where the target must visit a malicious pag...

MAL-2022-2142 Malicious code in competitive-equipment-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40b4dd892324e7e4fcb58dbd9ea6fc951d0647191e7d8733e0cd2d7f1b2d99ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in competitive-equipment-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40b4dd892324e7e4fcb58dbd9ea6fc951d0647191e7d8733e0cd2d7f1b2d99ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview competitive-equipment-icon is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

MAL-2022-3930 Malicious code in ionic-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09de95e7d76d2e16b11246cf303cad1b6e649a71e2c5757deaafabe8081d0114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ionic-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09de95e7d76d2e16b11246cf303cad1b6e649a71e2c5757deaafabe8081d0114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in icon-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d88cf998d4140ce1ace5f472b26111b02c4363162678fe2e97c4e4e88008244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3752 Malicious code in icon-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d88cf998d4140ce1ace5f472b26111b02c4363162678fe2e97c4e4e88008244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jenkins Cross-Site Scripting Vulnerability (CNVD-2022-65924)

Jenkins is an application of the Jenkins open source. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins suffers from a cross-site scripting vulnerability that stems from the fact that the help icon does not...

GHSA-7F84-P6R5-JR6Q Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.321 and LTS 2.332.1, the HTML output generated for new symbol-based SVG icons includes the title attribute of l:ionicon until Jenkins 2.334 and alt attribute of l:icon since Jenkins 2.335 without further escaping. This vulnerability is known to be exploitable by attackers with...

Code injection

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified j...

PT-2022-22037 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.320 through 2.355 Jenkins LTS versions 2.332.1 through 2.332.3 Description: The help icon in Jenkins does not escape the feature name that is part of its tooltip, resulting in a cross-site scripting XSS vulnerability. This...

Stored XSS in EditEstadoDocumento

Description In facturascripts/EditEstadoDocumento, the field Icon can be injected an XSS payload into it. Proof of Concept // PoC.js POST /facturascripts/EditEstadoDocumento?code=27&action=save-ok HTTP/1.1 Host: 127.0.0.1 Content-Length: 1224 Cache-Control: max-age=0 sec-ch-ua:...

Malicious code in ember-malibu-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23b2a42bd91fbae30356ea1a577b91c34c51ff581287780fbb36338dcb78a4a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @harrysforge/icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1c18e6ed5c1ebadaac3b5b8e4775f88140304ae0d97ab097dadcefdd907de2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shein-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 386e2f5ba0bfb4252a77d5c4f22efa158df543a3f4fba6cdeb5e7b8fe6e40e38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6083 Malicious code in shein-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 386e2f5ba0bfb4252a77d5c4f22efa158df543a3f4fba6cdeb5e7b8fe6e40e38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tinkoff-react-bui/svg-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf558b9a116b62aab931fcf875349acb6eb5f4171abaeac53c3fcdc8069f83b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-661 Malicious code in @tinkoff-react-bui/svg-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf558b9a116b62aab931fcf875349acb6eb5f4171abaeac53c3fcdc8069f83b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-component-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9610c2f8d11b979d1eb35782d93fafa64ebfa1b8a1220d3ac0243f40beab69a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...