GHSA-79W7-VH3H-8G4J yt-dlp File system modification and RCE through improper file-extension sanitization

Summary yt-dlp does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp also reads config from the working directory and on Windows executables will be executed from the yt-dlp...

WordPress WP-Lister Lite for Amazon Plugin <= 2.6.16 is vulnerable to Cross Site Scripting (XSS)

Software WP-Lister Lite for Amazon Type Plugin Vulnerable versions = 2.6.16 Fixed in 2.6.17 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37261 Patch priority Medium CVSS severity Medium 7.1 Developer WP Lab PSID 6ad653dd30ed Credits Le Ngoc Anh Required privileg...

Malwarebytes Premium Security stops 100% of malware during AV Lab test

Malwarebytes Premium Security has maintained its long-running, perfect record in protecting users against online threats by blocking 100% of the malware samples deployed in the AV Lab Cybersecurity Foundation’s “Advanced In-The-Wild Malware Test.” For its performance in the May 2024 evaluation,...

Malicious code in Reothor.Lab.EvilPackage (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2589 Malicious code in lab-npm-package (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lab-npm-package (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-34312

Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting XSS vulnerability via the component vplide.js...

PT-2024-25784 · Moodle · Virtual Programming Lab

Name of the Vulnerable Software and Affected Versions: Virtual Programming Lab for Moodle versions up to 4.2.3 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability was found in the component vplide.js. Recommendations: For versions up to 4.2.3, update ...

CVE-2024-34312: Improper Neutralization of Input During Web Page Generation

Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting XSS vulnerability via the component vplide.js...

CVE-2024-34312

Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting XSS vulnerability via the component vplide.js...

CVE-2024-34312

Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting XSS vulnerability via the component vplide.js...

CVE-2024-34312

CVE-2024-34312 affects Virtual Programming Lab for Moodle up to v4.2.3, with a cross-site scripting (XSS) vulnerability in the vplide.js component. The issue arises from insufficient input handling/escaping in vplide.js, enabling arbitrary script execution in the victim’s browser. Documented impa...

WordPress WP-Lister Lite for eBay Plugin <= 3.5.8 is vulnerable to Sensitive Data Exposure

Software WP-Lister Lite for eBay Type Plugin Vulnerable versions = 3.5.8 Fixed in 3.5.9 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-24709 Patch priority Low CVSS severity Low 7.5 Developer WP Lab PSID 227921a369c8 Credits Aman Rawat Required privileg...

CVE-2024-31586

A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0 . The root cause is the improper neutralization of input during web page generation, specifically via the Borrower Name , Department , and Remarks parameters. A remote attacker can exploit this ...

CVE-2024-36117

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...

CVE-2024-36117 Path traversal while serving Reposilite javadoc expanded files

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...

CVE-2024-36117 Path traversal while serving Reposilite javadoc expanded files

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...

CVE-2024-36116 Path traversal in Reposilite javadoc file expansion

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, JavadocEndpoints.kt controller allows to expand the...

CVE-2024-36116

The CVE-2024-36116 issue in Reposilite arises from path traversal in the Javadoc archive expansion logic. The archive’s file.name can contain traversal sequences (for example ../../../anything.txt), allowing an extracted path to escape the intended unpack directory. An attacker could craft a mali...

CVE-2024-36116 Path traversal in Reposilite javadoc file expansion

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, JavadocEndpoints.kt controller allows to expand the...