Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in crypto-js version 3.1.2

Summary A vulnerability has been identified in Crypto-Js 3.1.2, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions. Vulnerability Details CVEID:CVE-2023-46233 DESCRIPTION: Brix crypto-js could allo...

CVE-2024-13304

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-13304

The Drupal Minify JS module (versions before 3.0.3 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is that several administrator routes are unprotected against CSRF, allowing a malicious actor to manipulate cross-site requests. A successful exploit enables a remote a...

CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-13304: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2025-22546: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through = 1.0...

CVE-2024-56243

Missing Authorization vulnerability in JS Morisset WPSSO Core wpsso allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSSO Core: from n/a through = 18.18.1...

CVE-2024-56243 WordPress WPSSO Core plugin <= 18.18.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in JS Morisset WPSSO Core wpsso allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSSO Core: from n/a through = 18.18.1...

CVE-2024-56243: Missing Authorization

Missing Authorization vulnerability in JS Morisset WPSSO Core wpsso allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSSO Core: from n/a through = 18.18.1...

Malicious code in js-dos-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d534d9ec05d6809f40b3db232c0e24e612234ca30b7d46155b7aa6043c7d02a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12149 Malicious code in js-dos-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d534d9ec05d6809f40b3db232c0e24e612234ca30b7d46155b7aa6043c7d02a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Updated thunderbird packages fix security vulnerability

Matrix-js-sdk has insufficient MXC URI validation which could allow client-side path traversal. CVE-2024-50336...

MGASA-2024-0395 Updated thunderbird packages fix security vulnerability

Matrix-js-sdk has insufficient MXC URI validation which could allow client-side path traversal. CVE-2024-50336...

MAL-2024-12090 Malicious code in goji-js-org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1158451b8e262941308f40c4e30935ba7abac4515ecb1d090b6fd1be2e507198 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in goji-js-org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1158451b8e262941308f40c4e30935ba7abac4515ecb1d090b6fd1be2e507198 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-56334

systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the getWindowsIEEE8021x function. This means that malicious content in the SSID can be executed as OS commands. This...

CVE-2022-46840

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...

CVE-2022-46838

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...