CVE-2024-9146

CVE-2024-9146: WordPress plugin CSS JS Files <= 1.5.0 is affected by a path traversal vulnerability that could allow reading restricted files. Affected versions are listed as

CVE-2024-9146: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in jamesdlow CSS JS Files css-js-files allows Path Traversal.This issue affects CSS JS Files: from n/a through = 1.5.0...

AZL-50073 CVE-2024-47764 affecting package js-jquery 3.5.0-4

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

UBUNTU-CVE-2024-9393

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://pdf.js origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full...

@angular-materials/ngx-admin (>=1.0.0, <=1.0.1), @bndynet/bbootstrap (>=1.1.0, <=2.2.1) +41 more potentially affected by CVE-2024-53391 via pace-js (>=1.0.2, <=1.2.4)

pace-js NPM version =1.0.2, =1.0.0, =1.1.0, =1.0.0, =1.0.1, =0.0.0, =0.0.1, =2.0.2, =14.0.1, =1.0.4, =1.0.4, =1.0.114, =0.1.0, =0.20.0 - freeman-admintheme 1.2.1 and more Source cves: CVE-2024-53391 Source advisory: SNYK:JS-PACEJS-8136829...

Prototype Pollution

Overview pace-js is an Automatically add a progress bar to your site. Affected versions of this package are vulnerable to Prototype Pollution via the extend function, which recursively copies key-value pairs from the source object without properly validating property names. An attacker can exploi...

Prototype Pollution

Overview org.webjars.npm:pace-js is an Automatically add a progress bar to your site. Affected versions of this package are vulnerable to Prototype Pollution via the extend function, which recursively copies key-value pairs from the source object without properly validating property names. An...

LoLLMs 安全漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs versions prior to v9.8, which stems from an unverified path connection in the servejs function in app.py. An attacker exploiting this vulnerability can...

CVE-2024-47169 Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those...

CVE-2024-8725

Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with...

CVE-2024-8725: Unrestricted Upload of File with Dangerous Type

Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with...

SafeLine - Serve As A Reverse Proxy To Protect Your Web Services From Attacks And Exploits

SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web apps from attacks such as SQL...

WordPress CSS JS Files Plugin <= 1.5.0 is vulnerable to Directory Traversal

Software CSS JS Files Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.5.1 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-9146 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID eaa2d0720275 Credits jsjp Required privilege Administrator Published...

Malicious code in tq-assignment-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7f3696cd235e903c072e0f059768eac6d02449c0391742e708b6ce69250e1a15 The OpenSSF Package Analysis project identified 'tq-assignment-js' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

dingfanzu 跨站脚本漏洞

dingfanzu is a php-based food ordering website developed by gk2007, an individual developer. A cross-site scripting vulnerability exists in dingfanzu, which originates from the parameter address-name in the scripts/order.js file in the Order Checkout component and can lead to cross-site scripting...

Malicious code in kk4845.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38684730b01368b7ae01946765e8bb76b27127d47d68019c175e498d92f577fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8902 Malicious code in kk4845.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38684730b01368b7ae01946765e8bb76b27127d47d68019c175e498d92f577fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zama1.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2afbc5173ad05196006544f59dceeb925749886b3658d14e9fe6ef4fc721c4b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8910 Malicious code in zama1.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2afbc5173ad05196006544f59dceeb925749886b3658d14e9fe6ef4fc721c4b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-7389 · Unknown +1 · Matrix-Js-Sdk +1

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions 9.11.0 through 34.7.0 Description: The issue is related to the MatrixClient.sendSharedHistoryKeys method in the matrix-js-sdk, which is vulnerable to interception by malicious homeservers. This method is used to share...