WordPress plugin: Issues with code in uploading SVG, WEBP, and ICO files

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

Cross-site Scripting (XSS)

jenkins is vulnerable to cross-site scripting. The vulnerability exists because the help icon does not escape the feature name that is part of its tooltip which allows an attacker to inject and execute arbitrary javascript...

PT-2022-4474 · Tracker Software Products · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a...

CVE-2022-2736: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in SourceCodester Company Website CMS. It has been classified as critical. This affects an unknown part of the file /dashboard/updatelogo.php of the component Background Upload Logo Icon. The manipulation of the argument xfile/ufile leads to unrestricted upload. It is...

CVE-2022-34154

Authenticated author or higher user role Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin = 1.0.1 at WordPress...

PT-2022-23959 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.2.1.53537 Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this issue, where the target must visit a malicious pag...

MAL-2022-2142 Malicious code in competitive-equipment-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40b4dd892324e7e4fcb58dbd9ea6fc951d0647191e7d8733e0cd2d7f1b2d99ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in competitive-equipment-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40b4dd892324e7e4fcb58dbd9ea6fc951d0647191e7d8733e0cd2d7f1b2d99ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview competitive-equipment-icon is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

Malicious code in ionic-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09de95e7d76d2e16b11246cf303cad1b6e649a71e2c5757deaafabe8081d0114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3930 Malicious code in ionic-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09de95e7d76d2e16b11246cf303cad1b6e649a71e2c5757deaafabe8081d0114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in icon-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d88cf998d4140ce1ace5f472b26111b02c4363162678fe2e97c4e4e88008244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3752 Malicious code in icon-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d88cf998d4140ce1ace5f472b26111b02c4363162678fe2e97c4e4e88008244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jenkins Cross-Site Scripting Vulnerability (CNVD-2022-65924)

Jenkins is an application of the Jenkins open source. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins suffers from a cross-site scripting vulnerability that stems from the fact that the help icon does not...

GHSA-7F84-P6R5-JR6Q Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.321 and LTS 2.332.1, the HTML output generated for new symbol-based SVG icons includes the title attribute of l:ionicon until Jenkins 2.334 and alt attribute of l:icon since Jenkins 2.335 without further escaping. This vulnerability is known to be exploitable by attackers with...

Code injection

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified j...

CVE-2022-34170

In Jenkins 2.320 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting XSS vulnerability exploitable by attacker...

CVE-2022-34180: Incorrect Authorization

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified j...

CVE-2022-34170: Improper Neutralization of Input During Web Page Generation

In Jenkins 2.320 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting XSS vulnerability exploitable by attacker...

PT-2022-22037 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.320 through 2.355 Jenkins LTS versions 2.332.1 through 2.332.3 Description: The help icon in Jenkins does not escape the feature name that is part of its tooltip, resulting in a cross-site scripting XSS vulnerability. This...