GHSA-47H8-JMP3-9F28 pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

pyrage uses the Rust age crate for its underlying operations, and age is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to pyrage for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of pyrage before 1.2.0 lack plugin...

CVE-2024-5980 Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...

PT-2021-23944 · Unknown +1 · Express-Session +1

Name of the Vulnerable Software and Affected Versions: Etherpad versions prior to 1.8.16 Description: Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an .etherpad file that, when imported, might allow the attacker to gain admin privileges for the...

CVE-2021-41033

In all released versions of Eclipse Equinox, at least until version 4.21 September 2021, installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by...

CVE-2021-41033

In all released versions of Eclipse Equinox, at least until version 4.21 September 2021, installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by...

CVE-2020-22249

Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious plugin which contains the php files with extensions like PHP,phtml,php7 will be copied to the plugins directory which would lead to the...

GHSA-G39Q-F4RM-85X4 OS Command Injection in baserCMS

baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via upload of malicious plugins...

Command Injection

github.com/helm/helm is vulnerable to command injection. The name and YAML data from the plugin.yaml is not sanitized when a plugin is loaded from a given directory. This allows an attacker to inject arbitrary characters to cause unexpected behaviors such as loading of malicious plugins or spoofi...

1-Click iPhone and Android Exploits Target Tibetan Users via WhatsApp

A team of Canadian cybersecurity researchers has uncovered a sophisticated and targeted mobile hacking campaign that is targeting high-profile members of various Tibetan groups with one-click exploits for iOS and Android devices. Dubbed Poison Carp by University of Toronto's Citizen Lab, the...

WordPress Popuplink.js Website Redirection

A number of malicious plugins exist in Wordpress. Websites incorporating those plugins may redirect users to malicious websites...

The danger of third parties: ads, pipelines, and plugins

It may or may not be comforting to know that, ultimately, bulletproof security is out of your hands. You can have the most locked down PC on Earth, have two-factor authentication 2FA set up across the board, take sensible actions to protect your personal information, and read all the EULAs under...

e107 Cross-Site Forgery Request Vulnerability

e107 is an open source, free and PHP and MySQL based content management system CMS developed by e107 team. A cross-site request forgery vulnerability exists in e107 version 2.1.4 in plugin-installing, meta-changing, and settings-changing. A remote attacker can exploit this vulnerability to downlo...

CVE-2017-8098

The CVE-2017-8098 entry describes a cross-site request forgery in e107 2.1.4, enabling a malicious page to induce the application to download and install a plugin via forged requests during plugin-installing, meta-changing, or settings-changing. The affected software is e107 (CMS) version 2.1.4; ...