CVE-2023-2279

CVE-2023-2279 pertains to the WP Directory Kit WordPress plugin. Concrete details show a CSRF vulnerability in versions up to 1.2.1 due to missing/incorrect nonce validation in the admin_page_display function, enabling unauthenticated attackers to delete or modify plugin settings, import demo dat...

CVE-2023-2279 WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...

WordPress plugin WP Directory Kit 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A cross-site request forgery vulnerability...

SUSE: Security Advisory (SUSE-SU-2023:3495-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-18697 · WordPress · Wp Directory Kit

Name of the Vulnerable Software and Affected Versions: WP Directory Kit plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is due to missing or incorrect nonce validation on the admin page display function, making it possible for unauthenticated attackers to delete o...

Security Bulletin: z/Transaction Processing Facility is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]

Summary The Python Cryptographic Authority package is used by the z/TPF real-time insights dashboard starter kit when connecting to a MySQL database from Python. The starter kit was updated to address the vulnerability described by CVE-2023-38325. Vulnerability Details CVEID:CVE-2023-38325...

SUSE: Security Advisory (SUSE-SU-2023:3398-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in as-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a907d0f630e8178cb7ba1215d44dac15d4d698d71e40733cb66932ff43419de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1511 Malicious code in as-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a907d0f630e8178cb7ba1215d44dac15d4d698d71e40733cb66932ff43419de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Butterfly Button 安全漏洞

Butterfly Button is an application by the individual developers of TheButterflySDK who are actively involved in the fight against domestic violence. Butterfly Button suffers from a security vulnerability that stems from the presence of unauthorized behavior that can lead to the disclosure of...

Prototype Pollution

tree-kit is vulnerable to Prototype Pollution. The vulnerability occurs because the extend function when the unflat option is set can be used to add arbitrary properties to an object , including properties that are not defined in the object's prototype which allows an attacker to execute arbitrar...

3d-kit (>=0.0.1 <=0.0.14), @0x4447/broccoli (>=1.0.0 <=1.0.16) +144 more potentially affected by CVE-2023-38894 via tree-kit (>=0.0.4 <=0.6.2)

tree-kit NPM version =0.0.4, =0.0.1, =1.0.0, =2.0.0, =1.0.0, =1.18.0, =0.0.1, =1.0.5-master.20190403074739, =1.0.0-master.20180909013449, =0.1.0-master.20191109234452, =0.1.0-ipcrm-custom-event.20191122150318, =1.1.0, =0.1.0-master.20190319050251, =0.1.9-update-dependencies.20190319120645,...

tree-kit Prototype Pollution vulnerability

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function...

GHSA-5P42-M6F3-HPMJ tree-kit Prototype Pollution vulnerability

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function...

CVE-2023-38894

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function...

CVE-2023-38894

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function...

CVE-2023-38894

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function...

CVE-2023-38894

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function...

CVE-2023-38894

The CVE-2023-38894 entry concerns a Prototype Pollution vulnerability in Cronvel Tree-kit v0.7.4 and earlier. Affected component: the extend function used on nested objects. Root cause: prototype contamination allows an attacker to manipulate object prototypes, enabling remote arbitrary code exec...

PT-2023-8585 · Unknown · Cronvel Tree-Kit

Name of the Vulnerable Software and Affected Versions: Cronvel Tree-kit versions 0.7.4 and before Description: A Prototype Pollution issue in Cronvel Tree-kit allows a remote attacker to execute arbitrary code via the extend function. This issue is related to uncontrolled modification of object...