MAL-2023-442 Malicious code in firestore-stripe-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe8379e4865e08389112e877335adb792c71474239b3b6b500505ea736cde7f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Quick Paypal Payments Plugin <= 5.7.26.3 is vulnerable to Cross Site Scripting (XSS)

Software Quick Paypal Payments Type Plugin Vulnerable versions = 5.7.26.3 Fixed in 5.7.26.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1554 Patch priority Low CVSS severity Low 5.9 Developer Fullworks Plugins PSID ed1fcf733e50 Credits Pablo...

Malicious Package

Overview firestore-stripe-payments is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Mageia: Security Advisory (MGASA-2023-0076)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability in the implementation of the Google Chrome browser’s Web Payments application interface allows a perpetrator to circumvent security restrictions.

The vulnerability of the Google Chrome browser’s Web Payments application interface is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTML page...

The vulnerability in the implementation of the Google Chrome browser’s Web Payments application interface allows a perpetrator to circumvent security restrictions.

The vulnerability of the Google Chrome browser’s Web Payments application interface is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTML page...

Critical WooCommerce Payments Plugin Flaw Patched for 500,000+ WordPress Sites

Patches have been released for a critical security flaw impacting the WooCommerce Payments plugin for WordPress, which is installed on over 500,000 websites. The flaw, if left unresolved, could enable a bad actor to gain unauthorized admin access to impacted stores, the company said in an advisor...

WooCommerce Payments Plugin for WordPress 5.6.x < 5.6.2 Authentication Bypass

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

WordPress WooCommerce Payments Plugin Authentication Bypass Vulnerability (Mar 2023)

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:automattic:woopayments"; ifdescription...

PSA: Update Now! Critical Authentication Bypass in WooCommerce Payments Allows Site Takeover

This post has been updated with additional information that has become available since its publication The Wordfence Threat Intelligence team regularly monitors plugin updates and reviews any indicating that a potential security issue may have been addressed. Today, March 23, 2023, we noticed tha...

CVE-2022-47145

Reflected Cross-Site Scripting XSS vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin = 3.5.7 versions...

CVE-2022-47145

Reflected Cross-Site Scripting XSS vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin = 3.5.7 versions...

Cross site scripting

Reflected Cross-Site Scripting XSS vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin = 3.5.7 versions...

CVE-2022-47145

CVE-2022-47145 affects Blockonomics WordPress Bitcoin Payments by Blockonomics plugin versions

CVE-2022-47145 WordPress Blockonomics Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)

Reflected Cross-Site Scripting XSS vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin = 3.5.7 versions...

WordPress WooCommerce Payments Plugin <= 5.6.1 is vulnerable to Privilege Escalation

Software WooCommerce Payments Type Plugin Vulnerable versions = 5.6.1 Fixed in 5.6.2 OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-28121 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID af825d1466e0 Credits Michael Mazzolini...

WooCommerce Payments < 5.6.2 - Unauthenticated Privilege Escalation

The plugin has a flaw allowing unauthenticated attackers to create an admin account and take over the blog POST /wp-json/wp/v2/users HTTP/1.1 Host: 127.0.0.1 Upgrade-Insecure-Requests: 1 Accept:...

WooCommerce Payments < 5.6.2 - Unauthenticated Privilege Escalation

The plugin has a flaw allowing unauthenticated attackers to create an admin account and take over the blog PoC POST /wp-json/wp/v2/users HTTP/1.1 Host: 127.0.0.1 Upgrade-Insecure-Requests: 1 Accept:...

WordPress WP Express Checkout (Accept PayPal Payments) Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS)

Software WP Express Checkout Accept PayPal Payments Type Plugin Vulnerable versions = 2.2.8 Fixed in 2.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1469 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c8954f0fe6fa Credi...

Authentication Bypass

Google Chrome is vulnerable to Authentication Bypass. The vulnerability exists due to the insufficient policy enforcement in Web Payments API, which allows an attacker to bypass navigation restrictions via a crafted HTML page...