MAL-2024-1271 Malicious code in web-ar-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd6b41d316342a401f8e262adb37d1982a359946c37d5b6dbbf9903eed6c6ea0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress WP Club Manager Plugin <= 2.2.11 is vulnerable to Cross Site Scripting (XSS)

Software WP Club Manager Type Plugin Vulnerable versions = 2.2.11 Fixed in 2.2.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-32566 Patch priority Low CVSS severity Low 6.5 Developer WP Club Manager PSID 673c46e5f536 Credits CatFather Required...

WordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability

CSRF to XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Flash Video Player versions = 5.0.4...

WordPress Radio Player plugin <= 2.0.73 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Radio Player versions = 2.0.73...

CVE-2024-31941

Cross-Site Request Forgery CSRF vulnerability in CodePeople CP Media Player.This issue affects CP Media Player: from n/a through 1.1.3...

CVE-2024-31941 WordPress CP Media Player plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in CodePeople CP Media Player.This issue affects CP Media Player: from n/a through 1.1.3...

CVE-2024-31941

CVE-2024-31941 affects the WordPress CP Media Player plugin (versions ≤ 1.1.3). The vulnerability is a Cross-Site Request Forgery (CSRF) flaw, with unauthenticated exploitation potential as described by Patchstack; advisory notes indicate the issue has low severity (CVSS v3.1 base score 5.4) and ...

CVE-2024-31941 WordPress CP Media Player plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in CodePeople CP Media Player.This issue affects CP Media Player: from n/a through 1.1.3...

WordPress Flash Video Player Plugin <= 5.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Flash Video Player Type Plugin Vulnerable versions = 5.0.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32537 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 7ec38f6bbf4a Credits Dimas Maulana...

WordPress Radio Player Plugin <= 2.0.73 is vulnerable to Sensitive Data Exposure

Software Radio Player Type Plugin Vulnerable versions = 2.0.73 Fixed in 2.0.74 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-32506 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4e6e2407c28d Credits Steven Julian Required...

WordPress Plugin CP Media Player 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress Plugin CP Media Player A cross-sit...

VLC < 3.0.20 Multiple Vulnerabilities

The version of VLC media player installed on the remote host is prior to 3.0.20. It is, therefore, affected by multiple vulnerabilities: - Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket and results in a memor...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29023

CVE-2024-29023 affects Xibo CMS: session tokens are exposed in the session-search API response, enabling potential session hijacking when users have access to the sessions page. Affected software is Xibo: upgrades are recommended to close the issue. Remediation per sources: Upgrade to Xibo 3.3.10...

WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability

Unvalidated Redirects and Forwards vulnerability discovered by Byeongjun Jo Patchstack Alliance in WordPress Plugin FV Flowplayer Video Player versions = 7.5.44.7212...

CVE-2024-31343

Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.1...

CVE-2024-31343

Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.1...

CVE-2024-31343 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10.1 - Arbitrary File Download vulnerability

Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.1...

CVE-2024-31343

CVE-2024-31343 affects the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin, with a Missing Authorization vulnerability reachable unauthenticated, allowing Arbitrary File Download from versions up to 4.10.1 (affected range: n/a through 4.10.1). Root cause per the connected d...

CVE-2024-31343 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10.1 - Arbitrary File Download vulnerability

Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.1...